Re: [PATCH 04/13] Apparmor: Use simple_start_creating() / simple_done_creating()

NeilBrown
2026-02-06T00:21:21Z

On Thu, 05 Feb 2026, Jeff Layton wrote:
> On Wed, 2026-02-04 at 15:57 +1100, NeilBrown wrote:
> > From: NeilBrown <neil@brown.name>
> >
> > Instead of explicitly locking the parent and performing a look up in
> > apparmor, use simple_start_creating(), and then simple_done_creating()
> > to unlock and drop the dentry.
> >
> > This removes the need to check for an existing entry (as
> > simple_start_creating() acts like an exclusive create and can return
> > -EEXIST), simplifies error paths, and keeps dir locking code
> > centralised.
> >
> > Signed-off-by: NeilBrown <neil@brown.name>
> > ---
> > security/apparmor/apparmorfs.c | 38 ++++++++--------------------------
> > 1 file changed, 9 insertions(+), 29 deletions(-)
> >
> > diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
> > index 907bd2667e28..7f78c36e6e50 100644
> > --- a/security/apparmor/apparmorfs.c
> > +++ b/security/apparmor/apparmorfs.c
> > @@ -282,32 +282,19 @@ static struct dentry *aafs_create(const char *name, umode_t mode,
> >
> > dir = d_inode(parent);
> >
> > - inode_lock(dir);
> > - dentry = lookup_noperm(&QSTR(name), parent);
> > + dentry = simple_start_creating(parent, name);
> > if (IS_ERR(dentry)) {
> > error = PTR_ERR(dentry);
> > - goto fail_lock;
> > - }
> > -
> > - if (d_really_is_positive(dentry)) {
> > - error = -EEXIST;
> > - goto fail_dentry;
> > + goto fail;
> > }
> >
> > error = __aafs_setup_d_inode(dir, dentry, mode, data, link, fops, iops);
> > + simple_done_creating(dentry);
> > if (error)
> > - goto fail_dentry;
> > - inode_unlock(dir);
> > -
> > - return dentry;
> > -
> > -fail_dentry:
> > - dput(dentry);
> > -
> > -fail_lock:
> > - inode_unlock(dir);
> > + goto fail;
> > + return 0;
>
> As KTR points out, this should be "return NULL;"

Actually it should be "return dentry;" which is what the original code
did.
I've no idea how it became 0...
Callers of aafs_create() will silently treat NULL as failure.

>
> > +fail:
> > simple_release_fs(&aafs_mnt, &aafs_count);
> > -
> > return ERR_PTR(error);
> > }
> >
> > @@ -2572,8 +2559,7 @@ static int aa_mk_null_file(struct dentry *parent)
> > if (error)
> > return error;
> >
> > - inode_lock(d_inode(parent));
> > - dentry = lookup_noperm(&QSTR(NULL_FILE_NAME), parent);
> > + dentry = simple_start_creating(parent, NULL_FILE_NAME);
> > if (IS_ERR(dentry)) {
> > error = PTR_ERR(dentry);
> > goto out;
> > @@ -2581,7 +2567,7 @@ static int aa_mk_null_file(struct dentry *parent)
> > inode = new_inode(parent->d_inode->i_sb);
> > if (!inode) {
> > error = -ENOMEM;
> > - goto out1;
> > + goto out;
> > }
> >
> > inode->i_ino = get_next_ino();
> > @@ -2593,18 +2579,12 @@ static int aa_mk_null_file(struct dentry *parent)
> > aa_null.dentry = dget(dentry);
> > aa_null.mnt = mntget(mount);
> >
> > - error = 0;
> > -
> > -out1:
> > - dput(dentry);
> > out:
> > - inode_unlock(d_inode(parent));
> > + simple_done_creating(dentry);
> > simple_release_fs(&mount, &count);
> > return error;
> > }
> >
> > -
> > -
> > static const char *policy_get_link(struct dentry *dentry,
> > struct inode *inode,
> > struct delayed_call *done)
>
> Assuming you fix the minor problem above.
>
> Reviewed-by: Jeff Layton <jlayton@kernel.org>
>

Thanks,
NeilBrown