Re: [PATCH v6 1/4] fs: configfs: add helpers for opening non-configfs paths

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] fs: configfs: configfs_file_open() ignores O_NOFOLLOW flag
--

commit 76452a998ac4b5def9cd38ece0706188bd3e3ed4
Author: Runyu Xiao <runyu.xiao@seu.edu.cn>

fs: configfs: add helpers for opening non-configfs paths

This commit adds configfs_open_root() and configfs_file_open() to allow
configfs store callbacks to open non-configfs paths without re-entering
configfs and acquiring the same non-recursive semaphore again.

> diff --git a/fs/configfs/mount.c b/fs/configfs/mount.c
> --- a/fs/configfs/mount.c
> +++ b/fs/configfs/mount.c

[ ... ]

> @@ -118,6 +119,58 @@ static struct file_system_type configfs_fs_type = {

[ ... ]

> +struct file *configfs_file_open(const char *filename, int flags, umode_t mode)
> +{
> +	struct file *file;
> +	struct path path;
> +	int ret;
> +
> +	ret = kern_path(filename, LOOKUP_FOLLOW, &path);

[Severity: Medium]
Does hardcoding LOOKUP_FOLLOW here bypass the caller's O_NOFOLLOW intent if
it is provided in the flags?

If a caller invokes configfs_file_open() with flags containing O_NOFOLLOW
on a symlink, kern_path() will unconditionally resolve the symlink. The
resolved target is then passed to file_open_root() via configfs_open_root().
Because file_open_root() only checks if the resolved target itself is a
symlink, this successfully bypasses the O_NOFOLLOW intent, silently
traversing the symlink instead of failing.

> +	if (ret)
> +		return ERR_PTR(ret);
> +
> +	file = configfs_open_root(&path, "", flags, mode);
> +	path_put(&path);
> +	return file;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926092148.128937-1-runyu.xiao@seu.edu.cn?part=1