[PATCH] securityfs: use kstrdup_const() to manage symlink targets

[PATCH] securityfs: use kstrdup_const() to manage symlink targets

[Dmitry Antipov]

Since 'target' argument of 'securityfs_create_symlink()' is (for
now at least) a compile-time constant, it may be reasonable to
use 'kstrdup_const()' / 'kree_const()' to manage 'i_link' member
of the corresponding inode in attempt to reuse .rodata instance
rather than making a copy.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
 security/inode.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/security/inode.c b/security/inode.c
index 81fb5d6dd33e..080402367674 100644
--- a/security/inode.c
+++ b/security/inode.c
@@ -30,7 +30,7 @@ static int mount_count;
 static void securityfs_free_inode(struct inode *inode)
 {
 	if (S_ISLNK(inode->i_mode))
-		kfree(inode->i_link);
+		kfree_const(inode->i_link);
 	free_inode_nonrcu(inode);
 }
 
@@ -258,17 +258,17 @@ struct dentry *securityfs_create_symlink(const char *name,
 					 const struct inode_operations *iops)
 {
 	struct dentry *dent;
-	char *link = NULL;
+	const char *link = NULL;
 
 	if (target) {
-		link = kstrdup(target, GFP_KERNEL);
+		link = kstrdup_const(target, GFP_KERNEL);
 		if (!link)
 			return ERR_PTR(-ENOMEM);
 	}
 	dent = securityfs_create_dentry(name, S_IFLNK | 0444, parent,
-					link, NULL, iops);
+					(void *)link, NULL, iops);
 	if (IS_ERR(dent))
-		kfree(link);
+		kfree_const(link);
 
 	return dent;
 }
-- 
2.53.0

Re: [PATCH] securityfs: use kstrdup_const() to manage symlink targets

[Paul Moore]

On Mar 17, 2026 Dmitry Antipov <dmantipov@yandex.ru> wrote:
> 
> Since 'target' argument of 'securityfs_create_symlink()' is (for
> now at least) a compile-time constant, it may be reasonable to
> use 'kstrdup_const()' / 'kree_const()' to manage 'i_link' member
> of the corresponding inode in attempt to reuse .rodata instance
> rather than making a copy.
> 
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> ---
>  security/inode.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)

Seems reasonable, we can easily back this out if we ever need to support
non-const link target strings.  Merged into lsm/dev, thanks.

--
paul-moore.com