From: Tejun Heo <tj@kernel.org>
To: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Christian Brauner <christian@brauner.io>,
Meta kernel team <kernel-team@meta.com>,
linux-kselftest@vger.kernel.org, driver-core@lists.linux.dev,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/3] kernfs: take kernfs_rename_lock for same-parent renames too
Date: Thu, 3 Sep 2026 10:21:44 -1000 [thread overview]
Message-ID: <apnW2A-0rHqhd8KE@slm.duckdns.org> (raw)
In-Reply-To: <20260903040253.670020-1-shakeel.butt@linux.dev>
Hello,
On Wed, Sep 02, 2026 at 09:02:51PM -0700, Shakeel Butt wrote:
...
> CPU0 CPU1
> kernfs_path_from_node() on /a/b/c
> reads the name of a, gets "a"
> renames a to a2
> renames b to b2
> reads the name of b, gets "b2"
> returns "/a/b2/c"
>
> This hits roots without KERNFS_ROOT_INVARIANT_PARENT: sysfs, where the
> bad path can reach sysfs_warn_dup() and pr_cont_kernfs_path(), and
> resctrl, which renames a mon group inside its mon_groups directory.
> cgroup sets the flag, so it skips the lock and reads names under RCU
> alone; that case needs something else and is not addressed here.
Well, I'm not sure this is a real problem. Do we even have places where
multiple nodes along the hierarchy can be renamed? And the only thing we do
with the formatted paths is printing them out somewhere.
> So take the lock in both cases, and let kernfs_rcu_name() accept it the
> way kernfs_parent() already does for ->__parent. Same-parent renames
> are rare, the lock is per filesystem, and the locked section is at most
> three stores. It also gives a future rename sequence counter one place
> to sit that covers every rename.
>
> Fixes: 741c10b096bc ("kernfs: Use RCU to access kernfs_node::name.")
> Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>
That said, it theoretically is a bug, so, why not?
Acked-by: Tejun Heo <tj@kernel.org>
Thanks.
--
tejun
prev parent reply other threads:[~2026-09-03 20:21 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-03 4:02 [PATCH 1/3] kernfs: take kernfs_rename_lock for same-parent renames too Shakeel Butt
2026-09-03 4:02 ` [PATCH 2/3] kernfs: don't lose IN_DELETE_SELF when decoding a file handle Shakeel Butt
2026-09-03 20:23 ` Tejun Heo
2026-09-03 4:02 ` [PATCH 3/3] kernfs: fix up the unlocked attribute reads on the creation paths Shakeel Butt
2026-09-03 20:26 ` Tejun Heo
2026-09-03 21:15 ` Shakeel Butt
2026-09-03 4:31 ` [PATCH 1/3] kernfs: take kernfs_rename_lock for same-parent renames too Greg Kroah-Hartman
2026-09-03 5:37 ` Shakeel Butt
[not found] ` <6a990797.3e7a366d.3bd849.72d1SMTPIN_ADDED_BROKEN@mx.google.com>
2026-09-03 5:41 ` Greg Kroah-Hartman
2026-09-03 6:15 ` Shakeel Butt
2026-09-03 16:08 ` Shakeel Butt
2026-09-03 20:21 ` Tejun Heo [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=apnW2A-0rHqhd8KE@slm.duckdns.org \
--to=tj@kernel.org \
--cc=christian@brauner.io \
--cc=driver-core@lists.linux.dev \
--cc=gregkh@linuxfoundation.org \
--cc=kernel-team@meta.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=shakeel.butt@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox