From: Christian Brauner <brauner@kernel.org>
To: linux-fsdevel@vger.kernel.org,
Linus Torvalds <torvalds@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org,
Alexander Viro <viro@zeniv.linux.org.uk>,
Jens Axboe <axboe@kernel.dk>, Jan Kara <jack@suse.cz>,
Tejun Heo <tj@kernel.org>, Jann Horn <jannh@google.com>,
Christian Brauner <brauner@kernel.org>
Subject: [PATCH RFC v2 15/23] fs: add real_fs to track task's actual fs_struct
Date: Fri, 06 Mar 2026 00:30:18 +0100 [thread overview]
Message-ID: <20260306-work-kthread-nullfs-v2-15-ad1b4bed7d3e@kernel.org> (raw)
In-Reply-To: <20260306-work-kthread-nullfs-v2-0-ad1b4bed7d3e@kernel.org>
Add a real_fs field to task_struct that always mirrors the fs field.
This lays the groundwork for distinguishing between a task's permanent
fs_struct and one that is temporarily overridden via scoped_with_init_fs().
When a kthread temporarily overrides current->fs for path lookup, we
need to know the original fs_struct for operations like exit_fs() and
unshare_fs_struct() that must operate on the real, permanent fs.
For now real_fs is always equal to fs. It is maintained alongside fs in
all the relevant paths: exit_fs(), unshare_fs_struct(),
switch_fs_struct(), and copy_fs().
Also fix the argument passed to nullfs_userspace_init() in
switch_fs_struct(): pass the old fs_struct itself rather than the
conditional return value which is NULL when other users still hold
a reference, ensuring the PID 1 unshare detection actually works.
Signed-off-by: Christian Brauner <brauner@kernel.org>
---
fs/fs_struct.c | 10 +++++++---
include/linux/sched.h | 1 +
init/init_task.c | 1 +
kernel/fork.c | 4 +++-
4 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/fs/fs_struct.c b/fs/fs_struct.c
index 3ff79fb894c1..b9b9a327f299 100644
--- a/fs/fs_struct.c
+++ b/fs/fs_struct.c
@@ -89,12 +89,13 @@ void free_fs_struct(struct fs_struct *fs)
void exit_fs(struct task_struct *tsk)
{
- struct fs_struct *fs = tsk->fs;
+ struct fs_struct *fs = tsk->real_fs;
if (fs) {
int kill;
task_lock(tsk);
read_seqlock_excl(&fs->seq);
+ tsk->real_fs = NULL;
tsk->fs = NULL;
kill = !--fs->users;
read_sequnlock_excl(&fs->seq);
@@ -126,7 +127,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
int unshare_fs_struct(void)
{
- struct fs_struct *fs = current->fs;
+ struct fs_struct *fs = current->real_fs;
struct fs_struct *new_fs = copy_fs_struct(fs);
int kill;
@@ -135,8 +136,10 @@ int unshare_fs_struct(void)
task_lock(current);
read_seqlock_excl(&fs->seq);
+ VFS_WARN_ON_ONCE(fs != current->fs);
kill = !--fs->users;
current->fs = new_fs;
+ current->real_fs = new_fs;
read_sequnlock_excl(&fs->seq);
task_unlock(current);
@@ -177,13 +180,14 @@ struct fs_struct *switch_fs_struct(struct fs_struct *new_fs)
fs = current->fs;
read_seqlock_excl(&fs->seq);
+ VFS_WARN_ON_ONCE(current->fs != current->real_fs);
current->fs = new_fs;
+ current->real_fs = new_fs;
if (--fs->users)
new_fs = NULL;
else
new_fs = fs;
read_sequnlock_excl(&fs->seq);
-
nullfs_userspace_init(fs);
return new_fs;
}
diff --git a/include/linux/sched.h b/include/linux/sched.h
index a7b4a980eb2f..5c7b9df92ebb 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1179,6 +1179,7 @@ struct task_struct {
unsigned long last_switch_time;
#endif
/* Filesystem information: */
+ struct fs_struct *real_fs;
struct fs_struct *fs;
/* Open file information: */
diff --git a/init/init_task.c b/init/init_task.c
index 5c838757fc10..7d0b4a5927eb 100644
--- a/init/init_task.c
+++ b/init/init_task.c
@@ -152,6 +152,7 @@ struct task_struct init_task __aligned(L1_CACHE_BYTES) = {
RCU_POINTER_INITIALIZER(cred, &init_cred),
.comm = INIT_TASK_COMM,
.thread = INIT_THREAD,
+ .real_fs = &init_fs,
.fs = &init_fs,
.files = &init_files,
#ifdef CONFIG_IO_URING
diff --git a/kernel/fork.c b/kernel/fork.c
index 583078c69bbd..73f4ed82f656 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1593,6 +1593,8 @@ static int copy_mm(u64 clone_flags, struct task_struct *tsk)
static int copy_fs(u64 clone_flags, struct task_struct *tsk)
{
struct fs_struct *fs = current->fs;
+
+ VFS_WARN_ON_ONCE(current->fs != current->real_fs);
if (clone_flags & CLONE_FS) {
/* tsk->fs is already what we want */
read_seqlock_excl(&fs->seq);
@@ -1605,7 +1607,7 @@ static int copy_fs(u64 clone_flags, struct task_struct *tsk)
read_sequnlock_excl(&fs->seq);
return 0;
}
- tsk->fs = copy_fs_struct(fs);
+ tsk->real_fs = tsk->fs = copy_fs_struct(fs);
if (!tsk->fs)
return -ENOMEM;
return 0;
--
2.47.3
next prev parent reply other threads:[~2026-03-05 23:30 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-05 23:30 [PATCH RFC v2 00/23] fs,kthread: start all kthreads in nullfs Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 01/23] fs: notice when init abandons fs sharing Christian Brauner
2026-03-10 16:03 ` Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 02/23] fs: add scoped_with_init_fs() Christian Brauner
2026-03-09 15:19 ` Jann Horn
2026-03-10 11:30 ` Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 03/23] rnbd: use scoped_with_init_fs() for block device open Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 04/23] crypto: ccp: use scoped_with_init_fs() for SEV file access Christian Brauner
2026-03-09 15:37 ` Jann Horn
2026-03-10 11:33 ` Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 05/23] scsi: target: use scoped_with_init_fs() for ALUA metadata Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 06/23] scsi: target: use scoped_with_init_fs() for APTPL metadata Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 07/23] btrfs: use scoped_with_init_fs() for update_dev_time() Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 08/23] coredump: use scoped_with_init_fs() for coredump path resolution Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 09/23] fs: use scoped_with_init_fs() for kernel_read_file_from_path_initns() Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 10/23] ksmbd: use scoped_with_init_fs() for share path resolution Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 11/23] ksmbd: use scoped_with_init_fs() for filesystem info path lookup Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 12/23] ksmbd: use scoped_with_init_fs() for VFS path operations Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 13/23] initramfs: use scoped_with_init_fs() for rootfs unpacking Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 14/23] af_unix: use scoped_with_init_fs() for coredump socket lookup Christian Brauner
2026-03-05 23:30 ` Christian Brauner [this message]
2026-03-07 0:51 ` [PATCH RFC v2 15/23] fs: add real_fs to track task's actual fs_struct Askar Safin
2026-03-09 15:14 ` Jann Horn
2026-03-10 11:29 ` Christian Brauner
2026-03-10 16:05 ` Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 16/23] fs: make userspace_init_fs a dynamically-initialized pointer Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 17/23] fs: stop sharing fs_struct between init_task and pid 1 Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 18/23] fs: add umh argument to struct kernel_clone_args Christian Brauner
2026-03-09 16:06 ` Jann Horn
2026-03-10 11:58 ` Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 19/23] fs: add kthread_mntns() Christian Brauner
2026-03-07 2:04 ` Askar Safin
2026-03-05 23:30 ` [PATCH RFC v2 20/23] devtmpfs: create private mount namespace Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 21/23] nullfs: make nullfs multi-instance Christian Brauner
2026-03-05 23:30 ` [PATCH RFC v2 22/23] fs: start all kthreads in nullfs Christian Brauner
2026-03-07 22:17 ` Askar Safin
2026-03-05 23:30 ` [PATCH RFC v2 23/23] fs: stop rewriting kthread fs structs Christian Brauner
2026-03-07 2:19 ` [PATCH RFC v2 00/23] fs,kthread: start all kthreads in nullfs Askar Safin
2026-03-09 16:50 ` Jann Horn
2026-03-10 12:54 ` Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260306-work-kthread-nullfs-v2-15-ad1b4bed7d3e@kernel.org \
--to=brauner@kernel.org \
--cc=axboe@kernel.dk \
--cc=jack@suse.cz \
--cc=jannh@google.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=tj@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox