Re: [PATCH v2 09/14] vfs: change vfs_lookup_open() to use do_open(), not vfs_open()

[Jeff Layton <jlayton@kernel.org>]

On Sat, 2026-09-19 at 12:06 +1000, NeilBrown wrote:
> From: NeilBrown <neil@brown.name>
> 
> The vfs_open() call misses permission checks which should happen before
> an open is attempted (atomic_open does separate permission checks).
> 
> Much of the code in do_open() will have no effect as relevant LOOKUP_
> flags aren't set.  truncation will be done (which nfsd is not expected
> to use) along with some audit logs and security hook.  The important
> benefit is getting the may_open() check.
> 
> Signed-off-by: NeilBrown <neil@brown.name>
> ---
>  fs/namei.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/namei.c b/fs/namei.c
> index ba3e7e4b5fdb..8ef2d44b6108 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -4604,6 +4604,9 @@ out_dput:
>  	goto out;
>  }
>  
> +static int do_open(struct nameidata *nd,
> +		   struct file *file, const struct open_flags *op);
> +
>  /**
>   * vfs_lookup_open - open and possibly create a regular file
>   * @parent: directory to contain file
> @@ -4660,6 +4663,9 @@ struct file *vfs_lookup_open(struct path *parent, struct qstr *last,
>  	}
>  	op.open_flag = open_flag;
>  	op.mode = mode;
> +	op.acc_mode = ACC_MODE(open_flag);
> +	if (open_flag & O_TRUNC)
> +		op.acc_mode |= MAY_WRITE;
>  	dentry = lookup_open(&nd, file, &op);
>  
>  	if (IS_ERR(dentry))
> @@ -4677,7 +4683,7 @@ struct file *vfs_lookup_open(struct path *parent, struct qstr *last,
>  			error = -ELOOP;
>  	} else if (!(file->f_mode & FMODE_OPENED)) {
>  		nd.path.dentry = dentry;
> -		error = vfs_open(&nd.path, file);
> +		error = do_open(&nd, file, &op);
>  	}
>  	dput(dentry);
>  

I think the code looks right, but the vfs_open -> do_open change is
largely unmentioned in the changelog. It'd be good to flesh that out
some.

Reviewed-by: Jeff Layton <jlayton@kernel.org>