[PATCH bpf-next v1 00/11] fs: unified VFS ancestor walk for Landlock and BPF

[Justin Suess <utilityemal77@gmail.com>]

Howdy folks,

This series adds a VFS API for walking a path's ancestors that covers
both path-walk modes (refwalk and rcu-walk, plus the hybrid walk)
through a unified interface, converts Landlock to it, and exposes it
to BPF LSM programs.  It picks up Song Liu's bpf path iterator series [1]
where the discussion left it, and tries to be the synthesis of what came
out of that thread: a combination of the callback and open-coded approaches
proposed there.

The structure is unchanged from the RFC [2]: a stepwise engine private
to namei.c, a callback front-end for in-kernel callers (Landlock
is converted, fixing the follow_up() race Al reported, hence the
Fixes: tag on patch 3), and open-coded BPF iterators over the engine in
referenced and rcu flavors, with bpf_path_ancestors_legitimize()
escalating from the latter to the former mid-walk.  Patch 1 is carried
from Song's series.  See the RFC cover for the full background and API
listing.

This is v1 following the RFC and bot feedback, and some of the sillier
mistakes are rectified.

Biggest change is that Song's patch 4 adding BTF_TYPE_SAFE_TRUSTED is
dropped, following [3].  This code wasn't an issue in his original
patchset, because that implementation was refwalk only, whereas this
one handles rcu-walk.  The problem is that trusted types acquired under
RCU don't propagate their RCU-ness to their fields.  Thus marking the
path trusted allows you to use the dentry from an RCU-acquired struct
path outside RCU.

Verifier fixes propagating the RCU-ness to trusted fields can be done,
but it's best as a separate series where the idea can be examined more
closely.  Then marking the dentry as trusted will allow you to use the
dentry xattr kfuncs.  Nothing in this series strictly depends on having
a trusted dentry, nor will marking it trusted require changes in this
API.  See my follow up [4].

Other changes since the RFC:

- vfs_walk_ancestors() is introduced already built on the stepwise
  engine, and the RFC's restructuring patch became a pure exposure
  patch (patch 4): the engine is no longer rewritten mid-series.
- vfs_walk_handover() carries the position's flags over, so an
  escalated walk no longer drops VFS_WALK_POS_MOUNTPOINT.
- A failed bpf_path_ancestors_legitimize() marks the destination
  iterator with BPF_PATH_ANCESTORS_RETRY instead of leaving it
  indistinguishable from a walk that completed at the root; a drained
  source returns -ENOENT, a lost race returns -ECHILD.
- vfs_walk_start() warns on and masks unknown flag bits, which the
  engine shares the flags word with.
- mnt_undo_legitimize() asserts it is called inside an RCU read-side
  critical section.
- Selftests verify the walk actually reaches / (position count plus
  end-of-walk flags), use an acquired position only after the iterator
  is destroyed so the program's reference is provably what keeps it
  alive and retrigger when a concurrent mount anywhere in the system
  legitimately ends the lockless walks with RETRY.
- Stale comments and kernel-doc contracts fixed; notably, rcu-mode
  callback reads race with concurrent changes exactly as in a
  referenced walk, now stated at vfs_walk_ancestors().

Stuff deliberately not changed:

- vfs_walk_handover() validates the seqcount before taking the dentry
  reference, the reverse of __legitimize_path() [5].  That ordering is
  what lets a failed handover leave nothing to put inside the caller's
  RCU read-side critical section, and the window it opens is
  indistinguishable from a rename landing right after a successful
  handover, which any referenced walk tolerates anyway. This matches
  behavior with in-tree existing rcu-walk implementations.
- A callback that stops an rcu-mode walk gets no final seq
  revalidation [5].  This matches rcu-walk practice: may_lookup()
  returns hard verdicts from RCU data without one, and d_walk()'s
  D_WALK_QUIT skips its seqretry.  Keeping a position is what
  validates, via the handover.
- An "__uninit" iterator argument is marked initialized as it is
  processed, so a later "__iter" argument of the same kfunc aliasing
  the same stack slots would see it as initialized [6].  Reaching that
  needs a kfunc whose "__uninit" destination and "__iter" source share
  one iterator BTF type. The slots record the destination's type, so
  a mismatch fails the "__iter" check regardless of aliasing, which is
  what makes this immune.  Answered in [7].

Landlock kselftests pass in full (914/914 under UML) on this revision.

[1] https://lore.kernel.org/bpf/20250617061116.3681325-1-song@kernel.org/
[2] https://lore.kernel.org/bpf/20261006002020.2890858-1-utilityemal77@gmail.com/
[3] https://lore.kernel.org/bpf/efdfa80872c26e9e1b6fe11957ecba8e1b5ffcdad421e34281ed3ebd017b5752@mail.kernel.org/
[4] https://lore.kernel.org/bpf/asUBWNVtSzLXkXsF@zenbox/
[5] https://lore.kernel.org/bpf/20261006003305.44F761F000FF@smtp.kernel.org/
[6] https://lore.kernel.org/bpf/20261006003716.CC7791F000FF@smtp.kernel.org/
[7] https://lore.kernel.org/bpf/asUK2i4229DNzXLI@zenbox/

Justin Suess (10):
  namei: add vfs_walk_ancestors()
  landlock: convert ancestor walk to vfs_walk_ancestors()
  namei: expose the stepwise ancestor walk to fs/
  bpf: add a path ancestor iterator
  selftests/bpf: exercise the path ancestor iterator
  fs: add mnt_undo_legitimize()
  namei: add an rcu-walk mode to the ancestor walk
  bpf: support "__uninit" iterator arguments in generic kfuncs
  bpf: add a lockless path ancestor iterator
  selftests/bpf: exercise the lockless path ancestor iterator

Song Liu (1):
  namei: introduce __path_walk_parent()

 fs/bpf_fs_kfuncs.c                            | 248 ++++++++++++
 fs/internal.h                                 |  22 +
 fs/mount.h                                    |   1 +
 fs/namei.c                                    | 380 ++++++++++++++++--
 fs/namespace.c                                |  65 ++-
 include/linux/namei.h                         |  17 +
 kernel/bpf/verifier.c                         |  44 +-
 security/landlock/fs.c                        | 266 ++++++------
 .../selftests/bpf/prog_tests/path_ancestors.c |  86 ++++
 .../selftests/bpf/progs/path_ancestors.c      | 146 +++++++
 10 files changed, 1098 insertions(+), 177 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/path_ancestors.c
 create mode 100644 tools/testing/selftests/bpf/progs/path_ancestors.c


base-commit: 763187dbbf83764a57d5811168ef9de7b9a60e2d
-- 
2.55.0