From 4bfe0692d698f86fa033ae07c4b4f035fb6a74c4 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 13 Jan 2026 14:58:44 -0500 Subject: [PATCH 01/68] init_mknod(): turn into a trivial wrapper for do_mknodat() Same as init_unlink() and init_rmdir() already are; the only obstacle is do_mknodat() being static. Signed-off-by: Al Viro --- fs/init.c | 21 +-------------------- fs/internal.h | 1 + fs/namei.c | 2 +- 3 files changed, 3 insertions(+), 21 deletions(-) diff --git a/fs/init.c b/fs/init.c index e0f5429c0a49..746d02628bc3 100644 --- a/fs/init.c +++ b/fs/init.c @@ -140,26 +140,7 @@ int __init init_stat(const char *filename, struct kstat *stat, int flags) int __init init_mknod(const char *filename, umode_t mode, unsigned int dev) { - struct dentry *dentry; - struct path path; - int error; - - if (S_ISFIFO(mode) || S_ISSOCK(mode)) - dev = 0; - else if (!(S_ISBLK(mode) || S_ISCHR(mode))) - return -EINVAL; - - dentry = start_creating_path(AT_FDCWD, filename, &path, 0); - if (IS_ERR(dentry)) - return PTR_ERR(dentry); - - mode = mode_strip_umask(d_inode(path.dentry), mode); - error = security_path_mknod(&path, dentry, mode, dev); - if (!error) - error = vfs_mknod(mnt_idmap(path.mnt), path.dentry->d_inode, - dentry, mode, new_decode_dev(dev), NULL); - end_creating_path(&path, dentry); - return error; + return do_mknodat(AT_FDCWD, getname_kernel(filename), mode, dev); } int __init init_link(const char *oldname, const char *newname) diff --git a/fs/internal.h b/fs/internal.h index ab638d41ab81..7267aa0926a1 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -60,6 +60,7 @@ int may_linkat(struct mnt_idmap *idmap, const struct path *link); int do_renameat2(int olddfd, struct filename *oldname, int newdfd, struct filename *newname, unsigned int flags); int do_mkdirat(int dfd, struct filename *name, umode_t mode); +int do_mknodat(int dfd, struct filename *name, umode_t mode, unsigned int dev); int do_symlinkat(struct filename *from, int newdfd, struct filename *to); int do_linkat(int olddfd, struct filename *old, int newdfd, struct filename *new, int flags); diff --git a/fs/namei.c b/fs/namei.c index cf16b6822dd3..4595b355b3ce 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -5018,7 +5018,7 @@ static int may_mknod(umode_t mode) } } -static int do_mknodat(int dfd, struct filename *name, umode_t mode, +int do_mknodat(int dfd, struct filename *name, umode_t mode, unsigned int dev) { struct delegated_inode di = { }; From b0f27ace0812bf7551fa16acff9b4670c65190b8 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 13 Jan 2026 15:01:38 -0500 Subject: [PATCH 02/68] init_mkdir(): turn into a trivial wrapper for do_mkdirat() Signed-off-by: Al Viro --- fs/init.c | 19 +------------------ 1 file changed, 1 insertion(+), 18 deletions(-) diff --git a/fs/init.c b/fs/init.c index 746d02628bc3..4b1fd7675095 100644 --- a/fs/init.c +++ b/fs/init.c @@ -202,24 +202,7 @@ int __init init_unlink(const char *pathname) int __init init_mkdir(const char *pathname, umode_t mode) { - struct dentry *dentry; - struct path path; - int error; - - dentry = start_creating_path(AT_FDCWD, pathname, &path, - LOOKUP_DIRECTORY); - if (IS_ERR(dentry)) - return PTR_ERR(dentry); - mode = mode_strip_umask(d_inode(path.dentry), mode); - error = security_path_mkdir(&path, dentry, mode); - if (!error) { - dentry = vfs_mkdir(mnt_idmap(path.mnt), path.dentry->d_inode, - dentry, mode, NULL); - if (IS_ERR(dentry)) - error = PTR_ERR(dentry); - } - end_creating_path(&path, dentry); - return error; + return do_mkdirat(AT_FDCWD, getname_kernel(pathname), mode); } int __init init_rmdir(const char *pathname) From 8714a249da48cb6758a7980b1edc53ffc9024251 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 13 Jan 2026 15:02:36 -0500 Subject: [PATCH 03/68] init_symlink(): turn into a trivial wrapper for do_symlinkat() Signed-off-by: Al Viro --- fs/init.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/fs/init.c b/fs/init.c index 4b1fd7675095..27e149a4e8ce 100644 --- a/fs/init.c +++ b/fs/init.c @@ -180,19 +180,8 @@ out: int __init init_symlink(const char *oldname, const char *newname) { - struct dentry *dentry; - struct path path; - int error; - - dentry = start_creating_path(AT_FDCWD, newname, &path, 0); - if (IS_ERR(dentry)) - return PTR_ERR(dentry); - error = security_path_symlink(&path, dentry, oldname); - if (!error) - error = vfs_symlink(mnt_idmap(path.mnt), path.dentry->d_inode, - dentry, oldname, NULL); - end_creating_path(&path, dentry); - return error; + return do_symlinkat(getname_kernel(oldname), AT_FDCWD, + getname_kernel(newname)); } int __init init_unlink(const char *pathname) From 12b5bc2a0d337d31d681682401d624338e168bcd Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 13 Jan 2026 15:03:32 -0500 Subject: [PATCH 04/68] init_link(): turn into a trivial wrapper for do_linkat() Signed-off-by: Al Viro --- fs/init.c | 33 ++------------------------------- 1 file changed, 2 insertions(+), 31 deletions(-) diff --git a/fs/init.c b/fs/init.c index 27e149a4e8ce..da6500d2ee98 100644 --- a/fs/init.c +++ b/fs/init.c @@ -145,37 +145,8 @@ int __init init_mknod(const char *filename, umode_t mode, unsigned int dev) int __init init_link(const char *oldname, const char *newname) { - struct dentry *new_dentry; - struct path old_path, new_path; - struct mnt_idmap *idmap; - int error; - - error = kern_path(oldname, 0, &old_path); - if (error) - return error; - - new_dentry = start_creating_path(AT_FDCWD, newname, &new_path, 0); - error = PTR_ERR(new_dentry); - if (IS_ERR(new_dentry)) - goto out; - - error = -EXDEV; - if (old_path.mnt != new_path.mnt) - goto out_dput; - idmap = mnt_idmap(new_path.mnt); - error = may_linkat(idmap, &old_path); - if (unlikely(error)) - goto out_dput; - error = security_path_link(old_path.dentry, &new_path, new_dentry); - if (error) - goto out_dput; - error = vfs_link(old_path.dentry, idmap, new_path.dentry->d_inode, - new_dentry, NULL); -out_dput: - end_creating_path(&new_path, new_dentry); -out: - path_put(&old_path); - return error; + return do_linkat(AT_FDCWD, getname_kernel(oldname), + AT_FDCWD, getname_kernel(newname), 0); } int __init init_symlink(const char *oldname, const char *newname) From 24df85ffb9712cd6060588f6e08defcda5986efe Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 31 Oct 2025 13:16:03 -0400 Subject: [PATCH 05/68] allow to use CLASS() for struct filename * Not all users match that model, but most of them do. By the end of the series we'll be left with very few irregular ones... Added: CLASS(filename, name)(user_path) => getname(user_path) CLASS(filename_kernel, name)(string) => getname_kernel(string) CLASS(filename_flags, name)(user_path, flags) => getname_flags(user_path, flags) CLASS(filename_uflags, name)(user_path, flags) => getname_uflags(user_path, flags) CLASS(filename_maybe_null, name)(user_path, flags) => getname_maybe_null(user_path, flags) all with putname() as destructor. "flags" in filename_flags is in LOOKUP_... space, only LOOKUP_EMPTY matters. "flags" in filename_uflags and filename_maybe_null is in AT_...... space, and only AT_EMPTY_PATH matters. filename_flags conventions might be worth reconsidering later (it might or might not be better off with boolean instead) Signed-off-by: Al Viro --- include/linux/fs.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/linux/fs.h b/include/linux/fs.h index f5c9cf28c4dc..d49b969ab432 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2517,6 +2517,12 @@ static inline struct filename *refname(struct filename *name) return name; } +DEFINE_CLASS(filename, struct filename *, putname(_T), getname(p), const char __user *p) +EXTEND_CLASS(filename, _kernel, getname_kernel(p), const char *p) +EXTEND_CLASS(filename, _flags, getname_flags(p, f), const char __user *p, unsigned int f) +EXTEND_CLASS(filename, _uflags, getname_uflags(p, f), const char __user *p, unsigned int f) +EXTEND_CLASS(filename, _maybe_null, getname_maybe_null(p, f), const char __user *p, unsigned int f) + extern int finish_open(struct file *file, struct dentry *dentry, int (*open)(struct inode *, struct file *)); extern int finish_no_open(struct file *file, struct dentry *dentry); From 0cf1149673da1153d32eeea67771a002530fda42 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2025 00:48:31 -0400 Subject: [PATCH 06/68] do_faccessat(): import pathname only once Convert the user_path_at() call inside a retry loop into getname_flags() + filename_lookup() + putname() and leave only filename_lookup() inside the loop. Since we have the default logics for use of LOOKUP_EMPTY (passed iff AT_EMPTY_PATH is present in flags), just use getname_uflags() and don't bother with setting LOOKUP_EMPTY in lookup_flags - getname_uflags() will pass the right thing to getname_flags() and filename_lookup() doesn't care about LOOKUP_EMPTY at all. The things could be further simplified by use of cleanup.h stuff, but let's not clutter the patch with that. Signed-off-by: Al Viro --- fs/open.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/open.c b/fs/open.c index f328622061c5..f3bacc583ef0 100644 --- a/fs/open.c +++ b/fs/open.c @@ -468,6 +468,7 @@ static int do_faccessat(int dfd, const char __user *filename, int mode, int flag int res; unsigned int lookup_flags = LOOKUP_FOLLOW; const struct cred *old_cred = NULL; + struct filename *name; if (mode & ~S_IRWXO) /* where's F_OK, X_OK, W_OK, R_OK? */ return -EINVAL; @@ -477,8 +478,6 @@ static int do_faccessat(int dfd, const char __user *filename, int mode, int flag if (flags & AT_SYMLINK_NOFOLLOW) lookup_flags &= ~LOOKUP_FOLLOW; - if (flags & AT_EMPTY_PATH) - lookup_flags |= LOOKUP_EMPTY; if (access_need_override_creds(flags)) { old_cred = access_override_creds(); @@ -486,8 +485,9 @@ static int do_faccessat(int dfd, const char __user *filename, int mode, int flag return -ENOMEM; } + name = getname_uflags(filename, flags); retry: - res = user_path_at(dfd, filename, lookup_flags, &path); + res = filename_lookup(dfd, name, lookup_flags, &path, NULL); if (res) goto out; @@ -527,6 +527,7 @@ out_path_release: goto retry; } out: + putname(name); if (old_cred) put_cred(revert_creds(old_cred)); From 67591df968f4ceb12c1f5d7f9caebc668200856b Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2025 00:48:31 -0400 Subject: [PATCH 07/68] do_fchmodat(): import pathname only once Convert the user_path_at() call inside a retry loop into getname_flags() + filename_lookup() + putname() and leave only filename_lookup() inside the loop. Since we have the default logics for use of LOOKUP_EMPTY (passed iff AT_EMPTY_PATH is present in flags), just use getname_uflags() and don't bother with setting LOOKUP_EMPTY in lookup_flags - getname_uflags() will pass the right thing to getname_flags() and filename_lookup() doesn't care about LOOKUP_EMPTY at all. The things could be further simplified by use of cleanup.h stuff, but let's not clutter the patch with that. Signed-off-by: Al Viro --- fs/open.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/fs/open.c b/fs/open.c index f3bacc583ef0..82bfa06dbfa5 100644 --- a/fs/open.c +++ b/fs/open.c @@ -679,6 +679,7 @@ static int do_fchmodat(int dfd, const char __user *filename, umode_t mode, unsigned int flags) { struct path path; + struct filename *name; int error; unsigned int lookup_flags; @@ -686,11 +687,9 @@ static int do_fchmodat(int dfd, const char __user *filename, umode_t mode, return -EINVAL; lookup_flags = (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW; - if (flags & AT_EMPTY_PATH) - lookup_flags |= LOOKUP_EMPTY; - + name = getname_uflags(filename, flags); retry: - error = user_path_at(dfd, filename, lookup_flags, &path); + error = filename_lookup(dfd, name, lookup_flags, &path, NULL); if (!error) { error = chmod_common(&path, mode); path_put(&path); @@ -699,6 +698,7 @@ retry: goto retry; } } + putname(name); return error; } From 2e2d892fe9b7c27a415813019e5b4f86c761c9ab Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2025 00:48:31 -0400 Subject: [PATCH 08/68] do_fchownat(): import pathname only once Convert the user_path_at() call inside a retry loop into getname_flags() + filename_lookup() + putname() and leave only filename_lookup() inside the loop. Since we have the default logics for use of LOOKUP_EMPTY (passed iff AT_EMPTY_PATH is present in flags), just use getname_uflags() and don't bother with setting LOOKUP_EMPTY in lookup_flags - getname_uflags() will pass the right thing to getname_flags() and filename_lookup() doesn't care about LOOKUP_EMPTY at all. The things could be further simplified by use of cleanup.h stuff, but let's not clutter the patch with that. Signed-off-by: Al Viro --- fs/open.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/fs/open.c b/fs/open.c index 82bfa06dbfa5..a2d775bec8c1 100644 --- a/fs/open.c +++ b/fs/open.c @@ -801,17 +801,17 @@ int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group, int flag) { struct path path; - int error = -EINVAL; + int error; int lookup_flags; + struct filename *name; if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0) - goto out; + return -EINVAL; lookup_flags = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW; - if (flag & AT_EMPTY_PATH) - lookup_flags |= LOOKUP_EMPTY; + name = getname_uflags(filename, flag); retry: - error = user_path_at(dfd, filename, lookup_flags, &path); + error = filename_lookup(dfd, name, lookup_flags, &path, NULL); if (error) goto out; error = mnt_want_write(path.mnt); @@ -826,6 +826,7 @@ out_release: goto retry; } out: + putname(name); return error; } From b756d8ba831036ad5b385576d0bf20daf0beca7c Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2025 00:48:31 -0400 Subject: [PATCH 09/68] do_utimes_path(): import pathname only once Convert the user_path_at() call inside a retry loop into getname_flags() + filename_lookup() + putname() and leave only filename_lookup() inside the loop. Since we have the default logics for use of LOOKUP_EMPTY (passed iff AT_EMPTY_PATH is present in flags), just use getname_uflags() and don't bother with setting LOOKUP_EMPTY in lookup_flags - getname_uflags() will pass the right thing to getname_flags() and filename_lookup() doesn't care about LOOKUP_EMPTY at all. The things could be further simplified by use of cleanup.h stuff, but let's not clutter the patch with that. Signed-off-by: Al Viro --- fs/utimes.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/fs/utimes.c b/fs/utimes.c index 86f8ce8cd6b1..84889ea1780e 100644 --- a/fs/utimes.c +++ b/fs/utimes.c @@ -8,6 +8,7 @@ #include #include #include +#include "internal.h" static bool nsec_valid(long nsec) { @@ -83,27 +84,27 @@ static int do_utimes_path(int dfd, const char __user *filename, { struct path path; int lookup_flags = 0, error; + struct filename *name; if (flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) return -EINVAL; if (!(flags & AT_SYMLINK_NOFOLLOW)) lookup_flags |= LOOKUP_FOLLOW; - if (flags & AT_EMPTY_PATH) - lookup_flags |= LOOKUP_EMPTY; + name = getname_uflags(filename, flags); retry: - error = user_path_at(dfd, filename, lookup_flags, &path); + error = filename_lookup(dfd, name, lookup_flags, &path, NULL); if (error) - return error; - + goto out; error = vfs_utimes(&path, times); path_put(&path); if (retry_estale(error, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; goto retry; } - +out: + putname(name); return error; } From 592ab7fbb83ffe78378d7d25e15d8799d1f1df29 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2025 00:48:31 -0400 Subject: [PATCH 10/68] chdir(2): import pathname only once Convert the user_path_at() call inside a retry loop into getname_flags() + filename_lookup() + putname() and leave only filename_lookup() inside the loop. In this case we never pass LOOKUP_EMPTY, so getname_flags() is equivalent to plain getname(). The things could be further simplified by use of cleanup.h stuff, but let's not clutter the patch with that. Signed-off-by: Al Viro --- fs/open.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/open.c b/fs/open.c index a2d775bec8c1..67c114bdeac5 100644 --- a/fs/open.c +++ b/fs/open.c @@ -555,8 +555,9 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename) struct path path; int error; unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY; + struct filename *name = getname(filename); retry: - error = user_path_at(AT_FDCWD, filename, lookup_flags, &path); + error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); if (error) goto out; @@ -573,6 +574,7 @@ dput_and_out: goto retry; } out: + putname(name); return error; } From c3fa2b7cf5dda5a73480361303441db4ba7f0e6a Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2025 00:48:31 -0400 Subject: [PATCH 11/68] chroot(2): import pathname only once Convert the user_path_at() call inside a retry loop into getname_flags() + filename_lookup() + putname() and leave only filename_lookup() inside the loop. In this case we never pass LOOKUP_EMPTY, so getname_flags() is equivalent to plain getname(). The things could be further simplified by use of cleanup.h stuff, but let's not clutter the patch with that. Signed-off-by: Al Viro --- fs/open.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/open.c b/fs/open.c index 67c114bdeac5..6f48fa9c756a 100644 --- a/fs/open.c +++ b/fs/open.c @@ -600,8 +600,9 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename) struct path path; int error; unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY; + struct filename *name = getname(filename); retry: - error = user_path_at(AT_FDCWD, filename, lookup_flags, &path); + error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); if (error) goto out; @@ -625,6 +626,7 @@ dput_and_out: goto retry; } out: + putname(name); return error; } From 85a4fe3c99a78999e5ce41d51292a1b665f314be Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2025 00:48:31 -0400 Subject: [PATCH 12/68] user_statfs(): import pathname only once Convert the user_path_at() call inside a retry loop into getname_flags() + filename_lookup() + putname() and leave only filename_lookup() inside the loop. In this case we never pass LOOKUP_EMPTY, so getname_flags() is equivalent to plain getname(). The things could be further simplified by use of cleanup.h stuff, but let's not clutter the patch with that. Signed-off-by: Al Viro --- fs/statfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/statfs.c b/fs/statfs.c index a45ac85e6048..a5671bf6c7f0 100644 --- a/fs/statfs.c +++ b/fs/statfs.c @@ -99,8 +99,9 @@ int user_statfs(const char __user *pathname, struct kstatfs *st) struct path path; int error; unsigned int lookup_flags = LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT; + struct filename *name = getname(pathname); retry: - error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path); + error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); if (!error) { error = vfs_statfs(&path, st); path_put(&path); @@ -109,6 +110,7 @@ retry: goto retry; } } + putname(name); return error; } From cf6b819c229af0d692a0e288261b4d8d73554a0d Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2025 00:48:31 -0400 Subject: [PATCH 13/68] do_sys_truncate(): import pathname only once Convert the user_path_at() call inside a retry loop into getname_flags() + filename_lookup() + putname() and leave only filename_lookup() inside the loop. In this case we never pass LOOKUP_EMPTY, so getname_flags() is equivalent to plain getname(). The things could be further simplified by use of cleanup.h stuff, but let's not clutter the patch with that. Signed-off-by: Al Viro --- fs/open.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/open.c b/fs/open.c index 6f48fa9c756a..2fea68991d42 100644 --- a/fs/open.c +++ b/fs/open.c @@ -129,14 +129,16 @@ EXPORT_SYMBOL_GPL(vfs_truncate); int do_sys_truncate(const char __user *pathname, loff_t length) { unsigned int lookup_flags = LOOKUP_FOLLOW; + struct filename *name; struct path path; int error; if (length < 0) /* sorry, but loff_t says... */ return -EINVAL; + name = getname(pathname); retry: - error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path); + error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); if (!error) { error = vfs_truncate(&path, length); path_put(&path); @@ -145,6 +147,7 @@ retry: lookup_flags |= LOOKUP_REVAL; goto retry; } + putname(name); return error; } From 1ee5220eb364f7ac22fc6102e61c7b33e593f365 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2025 00:48:31 -0400 Subject: [PATCH 14/68] do_readlinkat(): import pathname only once Take getname_flags() and putname() outside of retry loop. Since getname_flags() is the only thing that cares about LOOKUP_EMPTY, don't bother with setting LOOKUP_EMPTY in lookup_flags - just pass it to getname_flags() and be done with that. The things could be further simplified by use of cleanup.h stuff, but let's not clutter the patch with that. Signed-off-by: Al Viro --- fs/stat.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/stat.c b/fs/stat.c index 6c79661e1b96..ee9ae2c3273a 100644 --- a/fs/stat.c +++ b/fs/stat.c @@ -566,13 +566,13 @@ static int do_readlinkat(int dfd, const char __user *pathname, struct path path; struct filename *name; int error; - unsigned int lookup_flags = LOOKUP_EMPTY; + unsigned int lookup_flags = 0; if (bufsiz <= 0) return -EINVAL; + name = getname_flags(pathname, LOOKUP_EMPTY); retry: - name = getname_flags(pathname, lookup_flags); error = filename_lookup(dfd, name, lookup_flags, &path, NULL); if (unlikely(error)) { putname(name); @@ -593,11 +593,11 @@ retry: error = (name->name[0] == '\0') ? -ENOENT : -EINVAL; } path_put(&path); - putname(name); if (retry_estale(error, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; goto retry; } + putname(name); return error; } From 41670a5900a8866b8cab52ab5936b5e9ef06fe91 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2025 01:54:52 -0400 Subject: [PATCH 15/68] get rid of audit_reusename() Originally we tried to avoid multiple insertions into audit names array during retry loop by a cute hack - memorize the userland pointer and if there already is a match, just grab an extra reference to it. Cute as it had been, it had problems - two identical pointers had audit aux entries merged, two identical strings did not. Having different behaviour for syscalls that differ only by addresses of otherwise identical string arguments is obviously wrong - if nothing else, compiler can decide to merge identical string literals. Besides, this hack does nothing for non-audited processes - they get a fresh copy for retry. It's not time-critical, but having behaviour subtly differ that way is bogus. These days we have very few places that import filename more than once (9 functions total) and it's easy to massage them so we get rid of all re-imports. With that done, we don't need audit_reusename() anymore. There's no need to memorize userland pointer either. Acked-by: Paul Moore Signed-off-by: Al Viro --- fs/namei.c | 11 +++-------- include/linux/audit.h | 11 ----------- include/linux/fs.h | 1 - kernel/auditsc.c | 23 ----------------------- 4 files changed, 3 insertions(+), 43 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index 4595b355b3ce..3ba712032f55 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -125,9 +125,8 @@ #define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname)) -static inline void initname(struct filename *name, const char __user *uptr) +static inline void initname(struct filename *name) { - name->uptr = uptr; name->aname = NULL; atomic_set(&name->refcnt, 1); } @@ -139,10 +138,6 @@ getname_flags(const char __user *filename, int flags) char *kname; int len; - result = audit_reusename(filename); - if (result) - return result; - result = __getname(); if (unlikely(!result)) return ERR_PTR(-ENOMEM); @@ -210,7 +205,7 @@ getname_flags(const char __user *filename, int flags) return ERR_PTR(-ENAMETOOLONG); } } - initname(result, filename); + initname(result); audit_getname(result); return result; } @@ -268,7 +263,7 @@ struct filename *getname_kernel(const char * filename) return ERR_PTR(-ENAMETOOLONG); } memcpy((char *)result->name, filename, len); - initname(result, NULL); + initname(result); audit_getname(result); return result; } diff --git a/include/linux/audit.h b/include/linux/audit.h index 536f8ee8da81..d936a604d056 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -316,7 +316,6 @@ extern void __audit_uring_exit(int success, long code); extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1, unsigned long a2, unsigned long a3); extern void __audit_syscall_exit(int ret_success, long ret_value); -extern struct filename *__audit_reusename(const __user char *uptr); extern void __audit_getname(struct filename *name); extern void __audit_inode(struct filename *name, const struct dentry *dentry, unsigned int flags); @@ -380,12 +379,6 @@ static inline void audit_syscall_exit(void *pt_regs) __audit_syscall_exit(success, return_code); } } -static inline struct filename *audit_reusename(const __user char *name) -{ - if (unlikely(!audit_dummy_context())) - return __audit_reusename(name); - return NULL; -} static inline void audit_getname(struct filename *name) { if (unlikely(!audit_dummy_context())) @@ -624,10 +617,6 @@ static inline struct audit_context *audit_context(void) { return NULL; } -static inline struct filename *audit_reusename(const __user char *name) -{ - return NULL; -} static inline void audit_getname(struct filename *name) { } static inline void audit_inode(struct filename *name, diff --git a/include/linux/fs.h b/include/linux/fs.h index d49b969ab432..abe9c95c4874 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2411,7 +2411,6 @@ extern struct kobject *fs_kobj; struct audit_names; struct filename { const char *name; /* pointer to actual string */ - const __user char *uptr; /* original userland pointer */ atomic_t refcnt; struct audit_names *aname; const char iname[]; diff --git a/kernel/auditsc.c b/kernel/auditsc.c index dd0563a8e0be..67d8da927381 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -2169,29 +2169,6 @@ static struct audit_names *audit_alloc_name(struct audit_context *context, return aname; } -/** - * __audit_reusename - fill out filename with info from existing entry - * @uptr: userland ptr to pathname - * - * Search the audit_names list for the current audit context. If there is an - * existing entry with a matching "uptr" then return the filename - * associated with that audit_name. If not, return NULL. - */ -struct filename * -__audit_reusename(const __user char *uptr) -{ - struct audit_context *context = audit_context(); - struct audit_names *n; - - list_for_each_entry(n, &context->names_list, list) { - if (!n->name) - continue; - if (n->name->uptr == uptr) - return refname(n->name); - } - return NULL; -} - /** * __audit_getname - add a name to the list * @name: name to add From ca2a04e84af79596e5cd9cfe697d5122ec39c8ce Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 19 Nov 2025 16:15:04 -0500 Subject: [PATCH 16/68] ntfs: ->d_compare() must not block ... so don't use __getname() there. Switch it (and ntfs_d_hash(), while we are at it) to kmalloc(PATH_MAX, GFP_NOWAIT). Yes, ntfs_d_hash() almost certainly can do with smaller allocations, but let ntfs folks deal with that - keep the allocation size as-is for now. Stop abusing names_cachep in ntfs, period - various uses of that thing in there have nothing to do with pathnames; just use k[mz]alloc() and be done with that. For now let's keep sizes as-in, but AFAICS none of the users actually want PATH_MAX. Signed-off-by: Al Viro --- fs/ntfs3/dir.c | 5 ++--- fs/ntfs3/fsntfs.c | 4 ++-- fs/ntfs3/inode.c | 13 ++++++------- fs/ntfs3/namei.c | 17 ++++++++--------- fs/ntfs3/xattr.c | 5 ++--- 5 files changed, 20 insertions(+), 24 deletions(-) diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c index b98e95d6b4d9..cf038d713f50 100644 --- a/fs/ntfs3/dir.c +++ b/fs/ntfs3/dir.c @@ -423,8 +423,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx) if (!dir_emit_dots(file, ctx)) return 0; - /* Allocate PATH_MAX bytes. */ - name = __getname(); + name = kmalloc(PATH_MAX, GFP_KERNEL); if (!name) return -ENOMEM; @@ -502,7 +501,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx) out: - __putname(name); + kfree(name); put_indx_node(node); if (err == 1) { diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c index 5f138f715835..bd67ba7b5015 100644 --- a/fs/ntfs3/fsntfs.c +++ b/fs/ntfs3/fsntfs.c @@ -2627,7 +2627,7 @@ int ntfs_set_label(struct ntfs_sb_info *sbi, u8 *label, int len) u32 uni_bytes; struct ntfs_inode *ni = sbi->volume.ni; /* Allocate PATH_MAX bytes. */ - struct cpu_str *uni = __getname(); + struct cpu_str *uni = kmalloc(PATH_MAX, GFP_KERNEL); if (!uni) return -ENOMEM; @@ -2671,6 +2671,6 @@ unlock_out: err = _ni_write_inode(&ni->vfs_inode, 0); out: - __putname(uni); + kfree(uni); return err; } diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c index 0a9ac5efeb67..edfb973e4e82 100644 --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -1281,7 +1281,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, fa |= FILE_ATTRIBUTE_READONLY; /* Allocate PATH_MAX bytes. */ - new_de = kmem_cache_zalloc(names_cachep, GFP_KERNEL); + new_de = kzalloc(PATH_MAX, GFP_KERNEL); if (!new_de) { err = -ENOMEM; goto out1; @@ -1702,7 +1702,7 @@ out3: ntfs_mark_rec_free(sbi, ino, false); out2: - __putname(new_de); + kfree(new_de); kfree(rp); out1: @@ -1723,7 +1723,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry) struct NTFS_DE *de; /* Allocate PATH_MAX bytes. */ - de = kmem_cache_zalloc(names_cachep, GFP_KERNEL); + de = kzalloc(PATH_MAX, GFP_KERNEL); if (!de) return -ENOMEM; @@ -1737,7 +1737,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry) err = ni_add_name(ntfs_i(d_inode(dentry->d_parent)), ni, de); out: - __putname(de); + kfree(de); return err; } @@ -1760,8 +1760,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry) if (ntfs_is_meta_file(sbi, ni->mi.rno)) return -EINVAL; - /* Allocate PATH_MAX bytes. */ - de = kmem_cache_zalloc(names_cachep, GFP_KERNEL); + de = kzalloc(PATH_MAX, GFP_KERNEL); if (!de) return -ENOMEM; @@ -1797,7 +1796,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry) out: ni_unlock(ni); - __putname(de); + kfree(de); return err; } diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c index 3b24ca02de61..b2af8f695e60 100644 --- a/fs/ntfs3/namei.c +++ b/fs/ntfs3/namei.c @@ -68,7 +68,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry, u32 flags) { struct ntfs_inode *ni = ntfs_i(dir); - struct cpu_str *uni = __getname(); + struct cpu_str *uni = kmalloc(PATH_MAX, GFP_KERNEL); struct inode *inode; int err; @@ -85,7 +85,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry, inode = dir_search_u(dir, uni, NULL); ni_unlock(ni); } - __putname(uni); + kfree(uni); } /* @@ -303,8 +303,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir, return err; } - /* Allocate PATH_MAX bytes. */ - de = __getname(); + de = kmalloc(PATH_MAX, GFP_KERNEL); if (!de) return -ENOMEM; @@ -349,7 +348,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir, ni_unlock(ni); ni_unlock(dir_ni); out: - __putname(de); + kfree(de); return err; } @@ -407,7 +406,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name) /* * Try slow way with current upcase table */ - uni = kmem_cache_alloc(names_cachep, GFP_NOWAIT); + uni = kmalloc(PATH_MAX, GFP_NOWAIT); if (!uni) return -ENOMEM; @@ -429,7 +428,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name) err = 0; out: - kmem_cache_free(names_cachep, uni); + kfree(uni); return err; } @@ -468,7 +467,7 @@ static int ntfs_d_compare(const struct dentry *dentry, unsigned int len1, * Try slow way with current upcase table */ sbi = dentry->d_sb->s_fs_info; - uni1 = __getname(); + uni1 = kmalloc(PATH_MAX, GFP_NOWAIT); if (!uni1) return -ENOMEM; @@ -498,7 +497,7 @@ static int ntfs_d_compare(const struct dentry *dentry, unsigned int len1, ret = !ntfs_cmp_names_cpu(uni1, uni2, sbi->upcase, false) ? 0 : 1; out: - __putname(uni1); + kfree(uni1); return ret; } diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c index c93df55e98d0..f3bb2c41c000 100644 --- a/fs/ntfs3/xattr.c +++ b/fs/ntfs3/xattr.c @@ -556,8 +556,7 @@ struct posix_acl *ntfs_get_acl(struct mnt_idmap *idmap, struct dentry *dentry, if (unlikely(is_bad_ni(ni))) return ERR_PTR(-EINVAL); - /* Allocate PATH_MAX bytes. */ - buf = __getname(); + buf = kmalloc(PATH_MAX, GFP_KERNEL); if (!buf) return ERR_PTR(-ENOMEM); @@ -588,7 +587,7 @@ struct posix_acl *ntfs_get_acl(struct mnt_idmap *idmap, struct dentry *dentry, if (!IS_ERR(acl)) set_cached_acl(inode, type, acl); - __putname(buf); + kfree(buf); return acl; } From 8ba29c85e2ef24764a05b557ebeca32f9bfafada Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 19 Nov 2025 17:15:23 -0500 Subject: [PATCH 17/68] getname_flags() massage, part 1 In case of long name don't reread what we'd already copied. memmove() it instead. That avoids the possibility of ending up with empty name there and the need to look at the flags on the slow path. Signed-off-by: Al Viro --- fs/namei.c | 33 ++++++++++++++++----------------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index 3ba712032f55..72ee663a9b6b 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -174,36 +174,35 @@ getname_flags(const char __user *filename, int flags) */ if (unlikely(len == EMBEDDED_NAME_MAX)) { const size_t size = offsetof(struct filename, iname[1]); - kname = (char *)result; + struct filename *p; /* * size is chosen that way we to guarantee that * result->iname[0] is within the same object and that * kname can't be equal to result->iname, no matter what. */ - result = kzalloc(size, GFP_KERNEL); - if (unlikely(!result)) { - __putname(kname); + p = kzalloc(size, GFP_KERNEL); + if (unlikely(!p)) { + __putname(result); return ERR_PTR(-ENOMEM); } - result->name = kname; - len = strncpy_from_user(kname, filename, PATH_MAX); + memmove(result, &result->iname, EMBEDDED_NAME_MAX); + kname = (char *)result; + p->name = kname; + len = strncpy_from_user(kname + EMBEDDED_NAME_MAX, + filename + EMBEDDED_NAME_MAX, + PATH_MAX - EMBEDDED_NAME_MAX); if (unlikely(len < 0)) { - __putname(kname); - kfree(result); + kfree(p); + __putname(result); return ERR_PTR(len); } - /* The empty path is special. */ - if (unlikely(!len) && !(flags & LOOKUP_EMPTY)) { - __putname(kname); - kfree(result); - return ERR_PTR(-ENOENT); - } - if (unlikely(len == PATH_MAX)) { - __putname(kname); - kfree(result); + if (unlikely(len == PATH_MAX - EMBEDDED_NAME_MAX)) { + kfree(p); + __putname(result); return ERR_PTR(-ENAMETOOLONG); } + result = p; } initname(result); audit_getname(result); From 8f2ac8481731fb5d01ad54f66aa0334a8913b3c2 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 19 Nov 2025 17:28:04 -0500 Subject: [PATCH 18/68] getname_flags() massage, part 2 Take the "long name" case into a helper (getname_long()). In case of failure have the caller deal with freeing the original struct filename. Signed-off-by: Al Viro --- fs/namei.c | 56 ++++++++++++++++++++++++++++-------------------------- 1 file changed, 29 insertions(+), 27 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index 72ee663a9b6b..953cd254216d 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -131,6 +131,32 @@ static inline void initname(struct filename *name) atomic_set(&name->refcnt, 1); } +static struct filename *getname_long(struct filename *old, + const char __user *filename) +{ + int len; + /* + * size is chosen that way we to guarantee that + * p->iname[0] is within the same object and that + * p->name can't be equal to p->iname, no matter what. + */ + const size_t size = offsetof(struct filename, iname[1]); + struct filename *p __free(kfree) = kzalloc(size, GFP_KERNEL); + if (unlikely(!p)) + return ERR_PTR(-ENOMEM); + + memmove(old, &old->iname, EMBEDDED_NAME_MAX); + p->name = (char *)old; + len = strncpy_from_user((char *)old + EMBEDDED_NAME_MAX, + filename + EMBEDDED_NAME_MAX, + PATH_MAX - EMBEDDED_NAME_MAX); + if (unlikely(len < 0)) + return ERR_PTR(len); + if (unlikely(len == PATH_MAX - EMBEDDED_NAME_MAX)) + return ERR_PTR(-ENAMETOOLONG); + return no_free_ptr(p); +} + struct filename * getname_flags(const char __user *filename, int flags) { @@ -173,34 +199,10 @@ getname_flags(const char __user *filename, int flags) * userland. */ if (unlikely(len == EMBEDDED_NAME_MAX)) { - const size_t size = offsetof(struct filename, iname[1]); - struct filename *p; - - /* - * size is chosen that way we to guarantee that - * result->iname[0] is within the same object and that - * kname can't be equal to result->iname, no matter what. - */ - p = kzalloc(size, GFP_KERNEL); - if (unlikely(!p)) { + struct filename *p = getname_long(result, filename); + if (IS_ERR(p)) { __putname(result); - return ERR_PTR(-ENOMEM); - } - memmove(result, &result->iname, EMBEDDED_NAME_MAX); - kname = (char *)result; - p->name = kname; - len = strncpy_from_user(kname + EMBEDDED_NAME_MAX, - filename + EMBEDDED_NAME_MAX, - PATH_MAX - EMBEDDED_NAME_MAX); - if (unlikely(len < 0)) { - kfree(p); - __putname(result); - return ERR_PTR(len); - } - if (unlikely(len == PATH_MAX - EMBEDDED_NAME_MAX)) { - kfree(p); - __putname(result); - return ERR_PTR(-ENAMETOOLONG); + return p; } result = p; } From c3a3577cdb351e74d6ff6bc328c3bee18ce69298 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 19 Nov 2025 19:19:24 -0500 Subject: [PATCH 19/68] struct filename: use names_cachep only for getname() and friends Instances of struct filename come from names_cachep (via __getname()). That is done by getname_flags() and getname_kernel() and these two are the main callers of __getname(). However, there are other callers that simply want to allocate PATH_MAX bytes for uses that have nothing to do with struct filename. We want saner allocation rules for long pathnames, so that struct filename would *always* come from names_cachep, with the out-of-line pathname getting kmalloc'ed. For that we need to be able to change the size of objects allocated by getname_flags()/getname_kernel(). That requires the rest of __getname() users to stop using names_cachep; we could explicitly switch all of those to kmalloc(), but that would cause quite a bit of noise. So the plan is to switch getname_...() to new helpers and turn __getname() into a wrapper for kmalloc(). Remaining __getname() users could be converted to explicit kmalloc() at leisure, hopefully along with figuring out what size do they really want - PATH_MAX is an overkill for some of them, used out of laziness ("we have a convenient helper that does 4K allocations and that's large enough, let's use it"). As a side benefit, names_cachep is no longer used outside of fs/namei.c, so we can move it there and be done with that. Signed-off-by: Al Viro --- fs/dcache.c | 8 +------- fs/internal.h | 2 ++ fs/namei.c | 37 ++++++++++++++++++++++++++++--------- include/linux/fs.h | 6 ++---- 4 files changed, 33 insertions(+), 20 deletions(-) diff --git a/fs/dcache.c b/fs/dcache.c index dc2fff4811d1..cf865c12cdf9 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -3290,10 +3290,6 @@ static void __init dcache_init(void) runtime_const_init(ptr, dentry_hashtable); } -/* SLAB cache for __getname() consumers */ -struct kmem_cache *names_cachep __ro_after_init; -EXPORT_SYMBOL(names_cachep); - void __init vfs_caches_init_early(void) { int i; @@ -3307,9 +3303,7 @@ void __init vfs_caches_init_early(void) void __init vfs_caches_init(void) { - names_cachep = kmem_cache_create_usercopy("names_cache", PATH_MAX, 0, - SLAB_HWCACHE_ALIGN|SLAB_PANIC, 0, PATH_MAX, NULL); - + filename_init(); dcache_init(); inode_init(); files_init(); diff --git a/fs/internal.h b/fs/internal.h index 7267aa0926a1..c7a34412399e 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -72,6 +72,8 @@ struct dentry *start_dirop(struct dentry *parent, struct qstr *name, unsigned int lookup_flags); int lookup_noperm_common(struct qstr *qname, struct dentry *base); +void __init filename_init(void); + /* * namespace.c */ diff --git a/fs/namei.c b/fs/namei.c index 953cd254216d..f0be36e257a7 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -125,6 +125,25 @@ #define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname)) +/* SLAB cache for struct filename instances */ +static struct kmem_cache *names_cachep __ro_after_init; + +void __init filename_init(void) +{ + names_cachep = kmem_cache_create_usercopy("names_cache", PATH_MAX, 0, + SLAB_HWCACHE_ALIGN|SLAB_PANIC, 0, PATH_MAX, NULL); +} + +static inline struct filename *alloc_filename(void) +{ + return kmem_cache_alloc(names_cachep, GFP_KERNEL); +} + +static inline void free_filename(struct filename *p) +{ + kmem_cache_free(names_cachep, p); +} + static inline void initname(struct filename *name) { name->aname = NULL; @@ -164,7 +183,7 @@ getname_flags(const char __user *filename, int flags) char *kname; int len; - result = __getname(); + result = alloc_filename(); if (unlikely(!result)) return ERR_PTR(-ENOMEM); @@ -181,13 +200,13 @@ getname_flags(const char __user *filename, int flags) */ if (unlikely(len <= 0)) { if (unlikely(len < 0)) { - __putname(result); + free_filename(result); return ERR_PTR(len); } /* The empty path is special. */ if (!(flags & LOOKUP_EMPTY)) { - __putname(result); + free_filename(result); return ERR_PTR(-ENOENT); } } @@ -201,7 +220,7 @@ getname_flags(const char __user *filename, int flags) if (unlikely(len == EMBEDDED_NAME_MAX)) { struct filename *p = getname_long(result, filename); if (IS_ERR(p)) { - __putname(result); + free_filename(result); return p; } result = p; @@ -242,7 +261,7 @@ struct filename *getname_kernel(const char * filename) struct filename *result; int len = strlen(filename) + 1; - result = __getname(); + result = alloc_filename(); if (unlikely(!result)) return ERR_PTR(-ENOMEM); @@ -254,13 +273,13 @@ struct filename *getname_kernel(const char * filename) tmp = kmalloc(size, GFP_KERNEL); if (unlikely(!tmp)) { - __putname(result); + free_filename(result); return ERR_PTR(-ENOMEM); } tmp->name = (char *)result; result = tmp; } else { - __putname(result); + free_filename(result); return ERR_PTR(-ENAMETOOLONG); } memcpy((char *)result->name, filename, len); @@ -287,10 +306,10 @@ void putname(struct filename *name) } if (unlikely(name->name != name->iname)) { - __putname(name->name); + free_filename((struct filename *)name->name); kfree(name); } else - __putname(name); + free_filename(name); } EXPORT_SYMBOL(putname); diff --git a/include/linux/fs.h b/include/linux/fs.h index abe9c95c4874..997d515bab32 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2539,10 +2539,8 @@ static inline int finish_open_simple(struct file *file, int error) extern void __init vfs_caches_init_early(void); extern void __init vfs_caches_init(void); -extern struct kmem_cache *names_cachep; - -#define __getname() kmem_cache_alloc(names_cachep, GFP_KERNEL) -#define __putname(name) kmem_cache_free(names_cachep, (void *)(name)) +#define __getname() kmalloc(PATH_MAX, GFP_KERNEL) +#define __putname(name) kfree(name) void emergency_thaw_all(void); extern int sync_filesystem(struct super_block *); From 8c888b31903cc2acfbf054c23d702caf68857810 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 19 Nov 2025 19:45:04 -0500 Subject: [PATCH 20/68] struct filename: saner handling of long names Always allocate struct filename from names_cachep, long name or short; short names would be embedded into struct filename. Longer ones do not cannibalize the original struct filename - put them into kmalloc'ed buffers (PATH_MAX-sized for import from userland, strlen() + 1 - for ones originating kernel-side, where we know the length beforehand). Cutoff length for short names is chosen so that struct filename would be 192 bytes long - that's both a multiple of 64 and large enough to cover the majority of real-world uses. Simplifies logics in getname()/putname() and friends. [fixed an embarrassing braino in EMBEDDED_NAME_MAX, first reported by Dan Carpenter] Signed-off-by: Al Viro --- fs/namei.c | 87 ++++++++++++++++++---------------------------- include/linux/fs.h | 10 ++++-- 2 files changed, 41 insertions(+), 56 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index f0be36e257a7..57043b81fe27 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -123,15 +123,14 @@ * PATH_MAX includes the nul terminator --RR. */ -#define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname)) - /* SLAB cache for struct filename instances */ static struct kmem_cache *names_cachep __ro_after_init; void __init filename_init(void) { - names_cachep = kmem_cache_create_usercopy("names_cache", PATH_MAX, 0, - SLAB_HWCACHE_ALIGN|SLAB_PANIC, 0, PATH_MAX, NULL); + names_cachep = kmem_cache_create_usercopy("names_cache", sizeof(struct filename), 0, + SLAB_HWCACHE_ALIGN|SLAB_PANIC, offsetof(struct filename, iname), + EMBEDDED_NAME_MAX, NULL); } static inline struct filename *alloc_filename(void) @@ -150,30 +149,23 @@ static inline void initname(struct filename *name) atomic_set(&name->refcnt, 1); } -static struct filename *getname_long(struct filename *old, - const char __user *filename) +static int getname_long(struct filename *name, const char __user *filename) { int len; - /* - * size is chosen that way we to guarantee that - * p->iname[0] is within the same object and that - * p->name can't be equal to p->iname, no matter what. - */ - const size_t size = offsetof(struct filename, iname[1]); - struct filename *p __free(kfree) = kzalloc(size, GFP_KERNEL); + char *p __free(kfree) = kmalloc(PATH_MAX, GFP_KERNEL); if (unlikely(!p)) - return ERR_PTR(-ENOMEM); + return -ENOMEM; - memmove(old, &old->iname, EMBEDDED_NAME_MAX); - p->name = (char *)old; - len = strncpy_from_user((char *)old + EMBEDDED_NAME_MAX, + memcpy(p, &name->iname, EMBEDDED_NAME_MAX); + len = strncpy_from_user(p + EMBEDDED_NAME_MAX, filename + EMBEDDED_NAME_MAX, PATH_MAX - EMBEDDED_NAME_MAX); if (unlikely(len < 0)) - return ERR_PTR(len); + return len; if (unlikely(len == PATH_MAX - EMBEDDED_NAME_MAX)) - return ERR_PTR(-ENAMETOOLONG); - return no_free_ptr(p); + return -ENAMETOOLONG; + name->name = no_free_ptr(p); + return 0; } struct filename * @@ -199,16 +191,9 @@ getname_flags(const char __user *filename, int flags) * Handle both empty path and copy failure in one go. */ if (unlikely(len <= 0)) { - if (unlikely(len < 0)) { - free_filename(result); - return ERR_PTR(len); - } - /* The empty path is special. */ - if (!(flags & LOOKUP_EMPTY)) { - free_filename(result); - return ERR_PTR(-ENOENT); - } + if (!len && !(flags & LOOKUP_EMPTY)) + len = -ENOENT; } /* @@ -217,14 +202,13 @@ getname_flags(const char __user *filename, int flags) * names_cache allocation for the pathname, and re-do the copy from * userland. */ - if (unlikely(len == EMBEDDED_NAME_MAX)) { - struct filename *p = getname_long(result, filename); - if (IS_ERR(p)) { - free_filename(result); - return p; - } - result = p; + if (unlikely(len == EMBEDDED_NAME_MAX)) + len = getname_long(result, filename); + if (unlikely(len < 0)) { + free_filename(result); + return ERR_PTR(len); } + initname(result); audit_getname(result); return result; @@ -260,29 +244,26 @@ struct filename *getname_kernel(const char * filename) { struct filename *result; int len = strlen(filename) + 1; + char *p; + + if (unlikely(len > PATH_MAX)) + return ERR_PTR(-ENAMETOOLONG); result = alloc_filename(); if (unlikely(!result)) return ERR_PTR(-ENOMEM); if (len <= EMBEDDED_NAME_MAX) { - result->name = (char *)result->iname; - } else if (len <= PATH_MAX) { - const size_t size = offsetof(struct filename, iname[1]); - struct filename *tmp; - - tmp = kmalloc(size, GFP_KERNEL); - if (unlikely(!tmp)) { + p = (char *)result->iname; + memcpy(p, filename, len); + } else { + p = kmemdup(filename, len, GFP_KERNEL); + if (unlikely(!p)) { free_filename(result); return ERR_PTR(-ENOMEM); } - tmp->name = (char *)result; - result = tmp; - } else { - free_filename(result); - return ERR_PTR(-ENAMETOOLONG); } - memcpy((char *)result->name, filename, len); + result->name = p; initname(result); audit_getname(result); return result; @@ -305,11 +286,9 @@ void putname(struct filename *name) return; } - if (unlikely(name->name != name->iname)) { - free_filename((struct filename *)name->name); - kfree(name); - } else - free_filename(name); + if (unlikely(name->name != name->iname)) + kfree(name->name); + free_filename(name); } EXPORT_SYMBOL(putname); diff --git a/include/linux/fs.h b/include/linux/fs.h index 997d515bab32..f0f1e8034539 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2409,13 +2409,19 @@ extern struct kobject *fs_kobj; /* fs/open.c */ struct audit_names; -struct filename { + +struct __filename_head { const char *name; /* pointer to actual string */ atomic_t refcnt; struct audit_names *aname; - const char iname[]; +}; +#define EMBEDDED_NAME_MAX (192 - sizeof(struct __filename_head)) +struct filename { + struct __filename_head; + const char iname[EMBEDDED_NAME_MAX]; }; static_assert(offsetof(struct filename, iname) % sizeof(long) == 0); +static_assert(sizeof(struct filename) % 64 == 0); static inline struct mnt_idmap *file_mnt_idmap(const struct file *file) { From 7ca83f8ebe86706c4164ac21871f4a5adb86a430 Mon Sep 17 00:00:00 2001 From: Mateusz Guzik Date: Mon, 1 Dec 2025 09:32:26 +0100 Subject: [PATCH 21/68] fs: hide names_cache behind runtime const machinery s/names_cachep/names_cache/ for consistency with dentry cache. Signed-off-by: Mateusz Guzik Signed-off-by: Al Viro --- fs/namei.c | 16 ++++++++++------ include/asm-generic/vmlinux.lds.h | 3 ++- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index 57043b81fe27..06d60808b0ff 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -41,6 +41,8 @@ #include #include +#include + #include "internal.h" #include "mount.h" @@ -124,23 +126,25 @@ */ /* SLAB cache for struct filename instances */ -static struct kmem_cache *names_cachep __ro_after_init; +static struct kmem_cache *__names_cache __ro_after_init; +#define names_cache runtime_const_ptr(__names_cache) void __init filename_init(void) { - names_cachep = kmem_cache_create_usercopy("names_cache", sizeof(struct filename), 0, - SLAB_HWCACHE_ALIGN|SLAB_PANIC, offsetof(struct filename, iname), - EMBEDDED_NAME_MAX, NULL); + __names_cache = kmem_cache_create_usercopy("names_cache", sizeof(struct filename), 0, + SLAB_HWCACHE_ALIGN|SLAB_PANIC, offsetof(struct filename, iname), + EMBEDDED_NAME_MAX, NULL); + runtime_const_init(ptr, __names_cache); } static inline struct filename *alloc_filename(void) { - return kmem_cache_alloc(names_cachep, GFP_KERNEL); + return kmem_cache_alloc(names_cache, GFP_KERNEL); } static inline void free_filename(struct filename *p) { - kmem_cache_free(names_cachep, p); + kmem_cache_free(names_cache, p); } static inline void initname(struct filename *name) diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h index 8ca130af301f..eeb070f330bd 100644 --- a/include/asm-generic/vmlinux.lds.h +++ b/include/asm-generic/vmlinux.lds.h @@ -972,7 +972,8 @@ #define RUNTIME_CONST_VARIABLES \ RUNTIME_CONST(shift, d_hash_shift) \ RUNTIME_CONST(ptr, dentry_hashtable) \ - RUNTIME_CONST(ptr, __dentry_cache) + RUNTIME_CONST(ptr, __dentry_cache) \ + RUNTIME_CONST(ptr, __names_cache) /* Alignment must be consistent with (kunit_suite *) in include/kunit/test.h */ #define KUNIT_TABLE() \ From a9900a27dfe58e638690a6c3e8d477daa548d192 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 6 Jan 2026 21:00:10 -0500 Subject: [PATCH 22/68] switch __getname_maybe_null() to CLASS(filename_flags) Signed-off-by: Al Viro --- fs/namei.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index 06d60808b0ff..f1a2161bd691 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -227,7 +227,6 @@ struct filename *getname_uflags(const char __user *filename, int uflags) struct filename *__getname_maybe_null(const char __user *pathname) { - struct filename *name; char c; /* try to save on allocations; loss on um, though */ @@ -236,12 +235,11 @@ struct filename *__getname_maybe_null(const char __user *pathname) if (!c) return NULL; - name = getname_flags(pathname, LOOKUP_EMPTY); - if (!IS_ERR(name) && !(name->name[0])) { - putname(name); - name = NULL; - } - return name; + CLASS(filename_flags, name)(pathname, LOOKUP_EMPTY); + /* empty pathname translates to NULL */ + if (!IS_ERR(name) && !(name->name[0])) + return NULL; + return no_free_ptr(name); } struct filename *getname_kernel(const char * filename) From 9fa3ec84587c5eca7580eafc27eee332bc3a5a0e Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2025 20:29:06 -0400 Subject: [PATCH 23/68] allow incomplete imports of filenames There are two filename-related problems in io_uring and its interplay with audit. Filenames are imported when request is submitted and used when it is processed. Unfortunately, the latter may very well happen in a different thread. In that case the reference to filename is put into the wrong audit_context - that of submitting thread, not the processing one. Audit logics is called by the latter, and it really wants to be able to find the names in audit_context current (== processing) thread. Another related problem is the headache with refcounts - normally all references to given struct filename are visible only to one thread (the one that uses that struct filename). io_uring violates that - an extra reference is stashed in audit_context of submitter. It gets dropped when submitter returns to userland, which can happen simultaneously with processing thread deciding to drop the reference it got. We paper over that by making refcount atomic, but that means pointless headache for everyone. Solution: the notion of partially imported filenames. Namely, already copied from userland, but *not* exposed to audit yet. io_uring can create that in submitter thread, and complete the import (obtaining the usual reference to struct filename) in processing thread. Object: struct delayed_filename. Primitives for working with it: delayed_getname(&delayed_filename, user_string) - copies the name from userland, returning 0 and stashing the address of (still incomplete) struct filename in delayed_filename on success and returning -E... on error. delayed_getname_uflags(&delayed_filename, user_string, atflags) - similar, in the same relation to delayed_getname() as getname_uflags() is to getname() complete_getname(&delayed_filename) - completes the import of filename stashed in delayed_filename and returns struct filename to caller, emptying delayed_filename. CLASS(filename_complete_delayed, name)(&delayed_filename) - variant of CLASS(filename) with complete_getname() for constructor. dismiss_delayed_filename(&delayed_filename) - destructor; drops whatever might be stashed in delayed_filename, emptying it. putname_to_delayed(&delayed_filename, name) - if name is shared, stashes its copy into delayed_filename and drops the reference to name, otherwise stashes the name itself in there. Signed-off-by: Al Viro --- fs/namei.c | 66 +++++++++++++++++++++++++--- include/linux/fs.h | 12 +++++ io_uring/fs.c | 101 +++++++++++++++++++++++-------------------- io_uring/openclose.c | 26 +++++------ io_uring/statx.c | 17 +++----- io_uring/xattr.c | 30 +++++-------- 6 files changed, 157 insertions(+), 95 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index f1a2161bd691..b76cc43fe89d 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -172,8 +172,8 @@ static int getname_long(struct filename *name, const char __user *filename) return 0; } -struct filename * -getname_flags(const char __user *filename, int flags) +static struct filename * +do_getname(const char __user *filename, int flags, bool incomplete) { struct filename *result; char *kname; @@ -214,10 +214,17 @@ getname_flags(const char __user *filename, int flags) } initname(result); - audit_getname(result); + if (likely(!incomplete)) + audit_getname(result); return result; } +struct filename * +getname_flags(const char __user *filename, int flags) +{ + return do_getname(filename, flags, false); +} + struct filename *getname_uflags(const char __user *filename, int uflags) { int flags = (uflags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : 0; @@ -242,7 +249,7 @@ struct filename *__getname_maybe_null(const char __user *pathname) return no_free_ptr(name); } -struct filename *getname_kernel(const char * filename) +static struct filename *do_getname_kernel(const char *filename, bool incomplete) { struct filename *result; int len = strlen(filename) + 1; @@ -267,9 +274,15 @@ struct filename *getname_kernel(const char * filename) } result->name = p; initname(result); - audit_getname(result); + if (likely(!incomplete)) + audit_getname(result); return result; } + +struct filename *getname_kernel(const char *filename) +{ + return do_getname_kernel(filename, false); +} EXPORT_SYMBOL(getname_kernel); void putname(struct filename *name) @@ -294,6 +307,49 @@ void putname(struct filename *name) } EXPORT_SYMBOL(putname); +static inline int __delayed_getname(struct delayed_filename *v, + const char __user *string, int flags) +{ + v->__incomplete_filename = do_getname(string, flags, true); + return PTR_ERR_OR_ZERO(v->__incomplete_filename); +} + +int delayed_getname(struct delayed_filename *v, const char __user *string) +{ + return __delayed_getname(v, string, 0); +} + +int delayed_getname_uflags(struct delayed_filename *v, const char __user *string, + int uflags) +{ + int flags = (uflags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : 0; + return __delayed_getname(v, string, flags); +} + +int putname_to_delayed(struct delayed_filename *v, struct filename *name) +{ + if (likely(atomic_read(&name->refcnt) == 1)) { + v->__incomplete_filename = name; + return 0; + } + v->__incomplete_filename = do_getname_kernel(name->name, true); + putname(name); + return PTR_ERR_OR_ZERO(v->__incomplete_filename); +} + +void dismiss_delayed_filename(struct delayed_filename *v) +{ + putname(no_free_ptr(v->__incomplete_filename)); +} + +struct filename *complete_getname(struct delayed_filename *v) +{ + struct filename *res = no_free_ptr(v->__incomplete_filename); + if (!IS_ERR(res)) + audit_getname(res); + return res; +} + /** * check_acl - perform ACL permission checking * @idmap: idmap of the mount the inode was found from diff --git a/include/linux/fs.h b/include/linux/fs.h index f0f1e8034539..f1612a7dffd0 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2516,6 +2516,17 @@ static inline struct filename *getname_maybe_null(const char __user *name, int f extern void putname(struct filename *name); DEFINE_FREE(putname, struct filename *, if (!IS_ERR_OR_NULL(_T)) putname(_T)) +struct delayed_filename { + struct filename *__incomplete_filename; // don't touch +}; +#define INIT_DELAYED_FILENAME(ptr) \ + ((void)(*(ptr) = (struct delayed_filename){})) +int delayed_getname(struct delayed_filename *, const char __user *); +int delayed_getname_uflags(struct delayed_filename *v, const char __user *, int); +void dismiss_delayed_filename(struct delayed_filename *); +int putname_to_delayed(struct delayed_filename *, struct filename *); +struct filename *complete_getname(struct delayed_filename *); + static inline struct filename *refname(struct filename *name) { atomic_inc(&name->refcnt); @@ -2527,6 +2538,7 @@ EXTEND_CLASS(filename, _kernel, getname_kernel(p), const char *p) EXTEND_CLASS(filename, _flags, getname_flags(p, f), const char __user *p, unsigned int f) EXTEND_CLASS(filename, _uflags, getname_uflags(p, f), const char __user *p, unsigned int f) EXTEND_CLASS(filename, _maybe_null, getname_maybe_null(p, f), const char __user *p, unsigned int f) +EXTEND_CLASS(filename, _complete_delayed, complete_getname(p), struct delayed_filename *p) extern int finish_open(struct file *file, struct dentry *dentry, int (*open)(struct inode *, struct file *)); diff --git a/io_uring/fs.c b/io_uring/fs.c index 37079a414eab..c04c6282210a 100644 --- a/io_uring/fs.c +++ b/io_uring/fs.c @@ -19,8 +19,8 @@ struct io_rename { struct file *file; int old_dfd; int new_dfd; - struct filename *oldpath; - struct filename *newpath; + struct delayed_filename oldpath; + struct delayed_filename newpath; int flags; }; @@ -28,22 +28,22 @@ struct io_unlink { struct file *file; int dfd; int flags; - struct filename *filename; + struct delayed_filename filename; }; struct io_mkdir { struct file *file; int dfd; umode_t mode; - struct filename *filename; + struct delayed_filename filename; }; struct io_link { struct file *file; int old_dfd; int new_dfd; - struct filename *oldpath; - struct filename *newpath; + struct delayed_filename oldpath; + struct delayed_filename newpath; int flags; }; @@ -51,6 +51,7 @@ int io_renameat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { struct io_rename *ren = io_kiocb_to_cmd(req, struct io_rename); const char __user *oldf, *newf; + int err; if (sqe->buf_index || sqe->splice_fd_in) return -EINVAL; @@ -63,14 +64,14 @@ int io_renameat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) ren->new_dfd = READ_ONCE(sqe->len); ren->flags = READ_ONCE(sqe->rename_flags); - ren->oldpath = getname(oldf); - if (IS_ERR(ren->oldpath)) - return PTR_ERR(ren->oldpath); + err = delayed_getname(&ren->oldpath, oldf); + if (unlikely(err)) + return err; - ren->newpath = getname(newf); - if (IS_ERR(ren->newpath)) { - putname(ren->oldpath); - return PTR_ERR(ren->newpath); + err = delayed_getname(&ren->newpath, newf); + if (unlikely(err)) { + dismiss_delayed_filename(&ren->oldpath); + return err; } req->flags |= REQ_F_NEED_CLEANUP; @@ -85,8 +86,9 @@ int io_renameat(struct io_kiocb *req, unsigned int issue_flags) WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); - ret = do_renameat2(ren->old_dfd, ren->oldpath, ren->new_dfd, - ren->newpath, ren->flags); + ret = do_renameat2(ren->old_dfd, complete_getname(&ren->oldpath), + ren->new_dfd, complete_getname(&ren->newpath), + ren->flags); req->flags &= ~REQ_F_NEED_CLEANUP; io_req_set_res(req, ret, 0); @@ -97,14 +99,15 @@ void io_renameat_cleanup(struct io_kiocb *req) { struct io_rename *ren = io_kiocb_to_cmd(req, struct io_rename); - putname(ren->oldpath); - putname(ren->newpath); + dismiss_delayed_filename(&ren->oldpath); + dismiss_delayed_filename(&ren->newpath); } int io_unlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { struct io_unlink *un = io_kiocb_to_cmd(req, struct io_unlink); const char __user *fname; + int err; if (sqe->off || sqe->len || sqe->buf_index || sqe->splice_fd_in) return -EINVAL; @@ -118,9 +121,9 @@ int io_unlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) return -EINVAL; fname = u64_to_user_ptr(READ_ONCE(sqe->addr)); - un->filename = getname(fname); - if (IS_ERR(un->filename)) - return PTR_ERR(un->filename); + err = delayed_getname(&un->filename, fname); + if (unlikely(err)) + return err; req->flags |= REQ_F_NEED_CLEANUP; req->flags |= REQ_F_FORCE_ASYNC; @@ -135,9 +138,9 @@ int io_unlinkat(struct io_kiocb *req, unsigned int issue_flags) WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); if (un->flags & AT_REMOVEDIR) - ret = do_rmdir(un->dfd, un->filename); + ret = do_rmdir(un->dfd, complete_getname(&un->filename)); else - ret = do_unlinkat(un->dfd, un->filename); + ret = do_unlinkat(un->dfd, complete_getname(&un->filename)); req->flags &= ~REQ_F_NEED_CLEANUP; io_req_set_res(req, ret, 0); @@ -148,13 +151,14 @@ void io_unlinkat_cleanup(struct io_kiocb *req) { struct io_unlink *ul = io_kiocb_to_cmd(req, struct io_unlink); - putname(ul->filename); + dismiss_delayed_filename(&ul->filename); } int io_mkdirat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { struct io_mkdir *mkd = io_kiocb_to_cmd(req, struct io_mkdir); const char __user *fname; + int err; if (sqe->off || sqe->rw_flags || sqe->buf_index || sqe->splice_fd_in) return -EINVAL; @@ -165,9 +169,9 @@ int io_mkdirat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) mkd->mode = READ_ONCE(sqe->len); fname = u64_to_user_ptr(READ_ONCE(sqe->addr)); - mkd->filename = getname(fname); - if (IS_ERR(mkd->filename)) - return PTR_ERR(mkd->filename); + err = delayed_getname(&mkd->filename, fname); + if (unlikely(err)) + return err; req->flags |= REQ_F_NEED_CLEANUP; req->flags |= REQ_F_FORCE_ASYNC; @@ -181,7 +185,7 @@ int io_mkdirat(struct io_kiocb *req, unsigned int issue_flags) WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); - ret = do_mkdirat(mkd->dfd, mkd->filename, mkd->mode); + ret = do_mkdirat(mkd->dfd, complete_getname(&mkd->filename), mkd->mode); req->flags &= ~REQ_F_NEED_CLEANUP; io_req_set_res(req, ret, 0); @@ -192,13 +196,14 @@ void io_mkdirat_cleanup(struct io_kiocb *req) { struct io_mkdir *md = io_kiocb_to_cmd(req, struct io_mkdir); - putname(md->filename); + dismiss_delayed_filename(&md->filename); } int io_symlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { struct io_link *sl = io_kiocb_to_cmd(req, struct io_link); const char __user *oldpath, *newpath; + int err; if (sqe->len || sqe->rw_flags || sqe->buf_index || sqe->splice_fd_in) return -EINVAL; @@ -209,14 +214,14 @@ int io_symlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) oldpath = u64_to_user_ptr(READ_ONCE(sqe->addr)); newpath = u64_to_user_ptr(READ_ONCE(sqe->addr2)); - sl->oldpath = getname(oldpath); - if (IS_ERR(sl->oldpath)) - return PTR_ERR(sl->oldpath); + err = delayed_getname(&sl->oldpath, oldpath); + if (unlikely(err)) + return err; - sl->newpath = getname(newpath); - if (IS_ERR(sl->newpath)) { - putname(sl->oldpath); - return PTR_ERR(sl->newpath); + err = delayed_getname(&sl->newpath, newpath); + if (unlikely(err)) { + dismiss_delayed_filename(&sl->oldpath); + return err; } req->flags |= REQ_F_NEED_CLEANUP; @@ -231,7 +236,8 @@ int io_symlinkat(struct io_kiocb *req, unsigned int issue_flags) WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); - ret = do_symlinkat(sl->oldpath, sl->new_dfd, sl->newpath); + ret = do_symlinkat(complete_getname(&sl->oldpath), sl->new_dfd, + complete_getname(&sl->newpath)); req->flags &= ~REQ_F_NEED_CLEANUP; io_req_set_res(req, ret, 0); @@ -242,6 +248,7 @@ int io_linkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { struct io_link *lnk = io_kiocb_to_cmd(req, struct io_link); const char __user *oldf, *newf; + int err; if (sqe->buf_index || sqe->splice_fd_in) return -EINVAL; @@ -254,14 +261,14 @@ int io_linkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) newf = u64_to_user_ptr(READ_ONCE(sqe->addr2)); lnk->flags = READ_ONCE(sqe->hardlink_flags); - lnk->oldpath = getname_uflags(oldf, lnk->flags); - if (IS_ERR(lnk->oldpath)) - return PTR_ERR(lnk->oldpath); + err = delayed_getname_uflags(&lnk->oldpath, oldf, lnk->flags); + if (unlikely(err)) + return err; - lnk->newpath = getname(newf); - if (IS_ERR(lnk->newpath)) { - putname(lnk->oldpath); - return PTR_ERR(lnk->newpath); + err = delayed_getname(&lnk->newpath, newf); + if (unlikely(err)) { + dismiss_delayed_filename(&lnk->oldpath); + return err; } req->flags |= REQ_F_NEED_CLEANUP; @@ -276,8 +283,8 @@ int io_linkat(struct io_kiocb *req, unsigned int issue_flags) WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); - ret = do_linkat(lnk->old_dfd, lnk->oldpath, lnk->new_dfd, - lnk->newpath, lnk->flags); + ret = do_linkat(lnk->old_dfd, complete_getname(&lnk->oldpath), + lnk->new_dfd, complete_getname(&lnk->newpath), lnk->flags); req->flags &= ~REQ_F_NEED_CLEANUP; io_req_set_res(req, ret, 0); @@ -288,6 +295,6 @@ void io_link_cleanup(struct io_kiocb *req) { struct io_link *sl = io_kiocb_to_cmd(req, struct io_link); - putname(sl->oldpath); - putname(sl->newpath); + dismiss_delayed_filename(&sl->oldpath); + dismiss_delayed_filename(&sl->newpath); } diff --git a/io_uring/openclose.c b/io_uring/openclose.c index 15dde9bd6ff6..aa3acb06247f 100644 --- a/io_uring/openclose.c +++ b/io_uring/openclose.c @@ -23,7 +23,7 @@ struct io_open { struct file *file; int dfd; u32 file_slot; - struct filename *filename; + struct delayed_filename filename; struct open_how how; unsigned long nofile; }; @@ -67,12 +67,9 @@ static int __io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe open->dfd = READ_ONCE(sqe->fd); fname = u64_to_user_ptr(READ_ONCE(sqe->addr)); - open->filename = getname(fname); - if (IS_ERR(open->filename)) { - ret = PTR_ERR(open->filename); - open->filename = NULL; + ret = delayed_getname(&open->filename, fname); + if (unlikely(ret)) return ret; - } req->flags |= REQ_F_NEED_CLEANUP; open->file_slot = READ_ONCE(sqe->file_index); @@ -121,6 +118,7 @@ int io_openat2(struct io_kiocb *req, unsigned int issue_flags) struct file *file; bool resolve_nonblock, nonblock_set; bool fixed = !!open->file_slot; + CLASS(filename_complete_delayed, name)(&open->filename); int ret; ret = build_open_flags(&open->how, &op); @@ -140,7 +138,7 @@ int io_openat2(struct io_kiocb *req, unsigned int issue_flags) goto err; } - file = do_filp_open(open->dfd, open->filename, &op); + file = do_filp_open(open->dfd, name, &op); if (IS_ERR(file)) { /* * We could hang on to this 'fd' on retrying, but seems like @@ -152,9 +150,13 @@ int io_openat2(struct io_kiocb *req, unsigned int issue_flags) ret = PTR_ERR(file); /* only retry if RESOLVE_CACHED wasn't already set by application */ - if (ret == -EAGAIN && - (!resolve_nonblock && (issue_flags & IO_URING_F_NONBLOCK))) - return -EAGAIN; + if (ret == -EAGAIN && !resolve_nonblock && + (issue_flags & IO_URING_F_NONBLOCK)) { + ret = putname_to_delayed(&open->filename, + no_free_ptr(name)); + if (likely(!ret)) + return -EAGAIN; + } goto err; } @@ -167,7 +169,6 @@ int io_openat2(struct io_kiocb *req, unsigned int issue_flags) ret = io_fixed_fd_install(req, issue_flags, file, open->file_slot); err: - putname(open->filename); req->flags &= ~REQ_F_NEED_CLEANUP; if (ret < 0) req_set_fail(req); @@ -184,8 +185,7 @@ void io_open_cleanup(struct io_kiocb *req) { struct io_open *open = io_kiocb_to_cmd(req, struct io_open); - if (open->filename) - putname(open->filename); + dismiss_delayed_filename(&open->filename); } int __io_close_fixed(struct io_ring_ctx *ctx, unsigned int issue_flags, diff --git a/io_uring/statx.c b/io_uring/statx.c index 5111e9befbfe..7bcae4a6c4a3 100644 --- a/io_uring/statx.c +++ b/io_uring/statx.c @@ -16,7 +16,7 @@ struct io_statx { int dfd; unsigned int mask; unsigned int flags; - struct filename *filename; + struct delayed_filename filename; struct statx __user *buffer; }; @@ -24,6 +24,7 @@ int io_statx_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { struct io_statx *sx = io_kiocb_to_cmd(req, struct io_statx); const char __user *path; + int ret; if (sqe->buf_index || sqe->splice_fd_in) return -EINVAL; @@ -36,14 +37,10 @@ int io_statx_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) sx->buffer = u64_to_user_ptr(READ_ONCE(sqe->addr2)); sx->flags = READ_ONCE(sqe->statx_flags); - sx->filename = getname_uflags(path, sx->flags); + ret = delayed_getname_uflags(&sx->filename, path, sx->flags); - if (IS_ERR(sx->filename)) { - int ret = PTR_ERR(sx->filename); - - sx->filename = NULL; + if (unlikely(ret)) return ret; - } req->flags |= REQ_F_NEED_CLEANUP; req->flags |= REQ_F_FORCE_ASYNC; @@ -53,11 +50,12 @@ int io_statx_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) int io_statx(struct io_kiocb *req, unsigned int issue_flags) { struct io_statx *sx = io_kiocb_to_cmd(req, struct io_statx); + CLASS(filename_complete_delayed, name)(&sx->filename); int ret; WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); - ret = do_statx(sx->dfd, sx->filename, sx->flags, sx->mask, sx->buffer); + ret = do_statx(sx->dfd, name, sx->flags, sx->mask, sx->buffer); io_req_set_res(req, ret, 0); return IOU_COMPLETE; } @@ -66,6 +64,5 @@ void io_statx_cleanup(struct io_kiocb *req) { struct io_statx *sx = io_kiocb_to_cmd(req, struct io_statx); - if (sx->filename) - putname(sx->filename); + dismiss_delayed_filename(&sx->filename); } diff --git a/io_uring/xattr.c b/io_uring/xattr.c index 322b94ff9e4b..0fb4e5303500 100644 --- a/io_uring/xattr.c +++ b/io_uring/xattr.c @@ -19,16 +19,14 @@ struct io_xattr { struct file *file; struct kernel_xattr_ctx ctx; - struct filename *filename; + struct delayed_filename filename; }; void io_xattr_cleanup(struct io_kiocb *req) { struct io_xattr *ix = io_kiocb_to_cmd(req, struct io_xattr); - if (ix->filename) - putname(ix->filename); - + dismiss_delayed_filename(&ix->filename); kfree(ix->ctx.kname); kvfree(ix->ctx.kvalue); } @@ -48,7 +46,7 @@ static int __io_getxattr_prep(struct io_kiocb *req, const char __user *name; int ret; - ix->filename = NULL; + INIT_DELAYED_FILENAME(&ix->filename); ix->ctx.kvalue = NULL; name = u64_to_user_ptr(READ_ONCE(sqe->addr)); ix->ctx.value = u64_to_user_ptr(READ_ONCE(sqe->addr2)); @@ -93,11 +91,7 @@ int io_getxattr_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) path = u64_to_user_ptr(READ_ONCE(sqe->addr3)); - ix->filename = getname(path); - if (IS_ERR(ix->filename)) - return PTR_ERR(ix->filename); - - return 0; + return delayed_getname(&ix->filename, path); } int io_fgetxattr(struct io_kiocb *req, unsigned int issue_flags) @@ -119,8 +113,8 @@ int io_getxattr(struct io_kiocb *req, unsigned int issue_flags) WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); - ret = filename_getxattr(AT_FDCWD, ix->filename, LOOKUP_FOLLOW, &ix->ctx); - ix->filename = NULL; + ret = filename_getxattr(AT_FDCWD, complete_getname(&ix->filename), + LOOKUP_FOLLOW, &ix->ctx); io_xattr_finish(req, ret); return IOU_COMPLETE; } @@ -132,7 +126,7 @@ static int __io_setxattr_prep(struct io_kiocb *req, const char __user *name; int ret; - ix->filename = NULL; + INIT_DELAYED_FILENAME(&ix->filename); name = u64_to_user_ptr(READ_ONCE(sqe->addr)); ix->ctx.cvalue = u64_to_user_ptr(READ_ONCE(sqe->addr2)); ix->ctx.kvalue = NULL; @@ -169,11 +163,7 @@ int io_setxattr_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) path = u64_to_user_ptr(READ_ONCE(sqe->addr3)); - ix->filename = getname(path); - if (IS_ERR(ix->filename)) - return PTR_ERR(ix->filename); - - return 0; + return delayed_getname(&ix->filename, path); } int io_fsetxattr_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) @@ -200,8 +190,8 @@ int io_setxattr(struct io_kiocb *req, unsigned int issue_flags) WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); - ret = filename_setxattr(AT_FDCWD, ix->filename, LOOKUP_FOLLOW, &ix->ctx); - ix->filename = NULL; + ret = filename_setxattr(AT_FDCWD, complete_getname(&ix->filename), + LOOKUP_FOLLOW, &ix->ctx); io_xattr_finish(req, ret); return IOU_COMPLETE; } From 741c97fecb6a4160014a76759e9b8c0880fc44f1 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 2 Nov 2025 01:01:47 -0400 Subject: [PATCH 24/68] struct filename ->refcnt doesn't need to be atomic ... or visible outside of audit, really. Note that references held in delayed_filename always have refcount 1, and from the moment of complete_getname() or equivalent point in getname...() there won't be any references to struct filename instance left in places visible to other threads. Acked-by: Paul Moore Signed-off-by: Al Viro --- fs/namei.c | 12 ++++++------ include/linux/fs.h | 8 +------- kernel/auditsc.c | 6 +++--- 3 files changed, 10 insertions(+), 16 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index b76cc43fe89d..f4359825ba48 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -150,7 +150,7 @@ static inline void free_filename(struct filename *p) static inline void initname(struct filename *name) { name->aname = NULL; - atomic_set(&name->refcnt, 1); + name->refcnt = 1; } static int getname_long(struct filename *name, const char __user *filename) @@ -292,13 +292,13 @@ void putname(struct filename *name) if (IS_ERR_OR_NULL(name)) return; - refcnt = atomic_read(&name->refcnt); + refcnt = name->refcnt; if (unlikely(refcnt != 1)) { if (WARN_ON_ONCE(!refcnt)) return; - if (!atomic_dec_and_test(&name->refcnt)) - return; + name->refcnt--; + return; } if (unlikely(name->name != name->iname)) @@ -328,12 +328,12 @@ int delayed_getname_uflags(struct delayed_filename *v, const char __user *string int putname_to_delayed(struct delayed_filename *v, struct filename *name) { - if (likely(atomic_read(&name->refcnt) == 1)) { + if (likely(name->refcnt == 1)) { v->__incomplete_filename = name; return 0; } + name->refcnt--; v->__incomplete_filename = do_getname_kernel(name->name, true); - putname(name); return PTR_ERR_OR_ZERO(v->__incomplete_filename); } diff --git a/include/linux/fs.h b/include/linux/fs.h index f1612a7dffd0..6a26ee347517 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2412,7 +2412,7 @@ struct audit_names; struct __filename_head { const char *name; /* pointer to actual string */ - atomic_t refcnt; + int refcnt; struct audit_names *aname; }; #define EMBEDDED_NAME_MAX (192 - sizeof(struct __filename_head)) @@ -2527,12 +2527,6 @@ void dismiss_delayed_filename(struct delayed_filename *); int putname_to_delayed(struct delayed_filename *, struct filename *); struct filename *complete_getname(struct delayed_filename *); -static inline struct filename *refname(struct filename *name) -{ - atomic_inc(&name->refcnt); - return name; -} - DEFINE_CLASS(filename, struct filename *, putname(_T), getname(p), const char __user *p) EXTEND_CLASS(filename, _kernel, getname_kernel(p), const char *p) EXTEND_CLASS(filename, _flags, getname_flags(p, f), const char __user *p, unsigned int f) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 67d8da927381..86a44b162a87 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -2191,7 +2191,7 @@ void __audit_getname(struct filename *name) n->name = name; n->name_len = AUDIT_NAME_FULL; name->aname = n; - refname(name); + name->refcnt++; } static inline int audit_copy_fcaps(struct audit_names *name, @@ -2323,7 +2323,7 @@ out_alloc: return; if (name) { n->name = name; - refname(name); + name->refcnt++; } out: @@ -2445,7 +2445,7 @@ void __audit_inode_child(struct inode *parent, if (found_parent) { found_child->name = found_parent->name; found_child->name_len = AUDIT_NAME_FULL; - refname(found_child->name); + found_child->name->refcnt++; } } From 58a49cc9ebb13efd1c56c3466b09240779ac46a2 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 31 Oct 2025 01:02:50 -0400 Subject: [PATCH 25/68] file_getattr(): filename_lookup() accepts ERR_PTR() as filename no need to check it in the caller Signed-off-by: Al Viro --- fs/file_attr.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/fs/file_attr.c b/fs/file_attr.c index 13cdb31a3e94..ddd4939af7b6 100644 --- a/fs/file_attr.c +++ b/fs/file_attr.c @@ -396,9 +396,6 @@ SYSCALL_DEFINE5(file_getattr, int, dfd, const char __user *, filename, return -EINVAL; name = getname_maybe_null(filename, at_flags); - if (IS_ERR(name)) - return PTR_ERR(name); - if (!name && dfd >= 0) { CLASS(fd, f)(dfd); if (fd_empty(f)) From def2a02a4cdce359084ba7f3ddc5ea204177a3de Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 31 Oct 2025 01:03:58 -0400 Subject: [PATCH 26/68] file_setattr(): filename_lookup() accepts ERR_PTR() as filename no need to check it in the caller Signed-off-by: Al Viro --- fs/file_attr.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/fs/file_attr.c b/fs/file_attr.c index ddd4939af7b6..f44ce46e1411 100644 --- a/fs/file_attr.c +++ b/fs/file_attr.c @@ -459,9 +459,6 @@ SYSCALL_DEFINE5(file_setattr, int, dfd, const char __user *, filename, return error; name = getname_maybe_null(filename, at_flags); - if (IS_ERR(name)) - return PTR_ERR(name); - if (!name && dfd >= 0) { CLASS(fd, f)(dfd); if (fd_empty(f)) From 1c38f1f9b0a62651db5afcd37b964eb6b377fe66 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 31 Oct 2025 01:06:29 -0400 Subject: [PATCH 27/68] move_mount(): filename_lookup() accepts ERR_PTR() as filename no need to check it in the caller Signed-off-by: Al Viro --- fs/namespace.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index c58674a20cad..9d0d8ed16264 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -4427,9 +4427,6 @@ SYSCALL_DEFINE5(move_mount, uflags = AT_EMPTY_PATH; to_name = getname_maybe_null(to_pathname, uflags); - if (IS_ERR(to_name)) - return PTR_ERR(to_name); - if (!to_name && to_dfd >= 0) { CLASS(fd_raw, f_to)(to_dfd); if (fd_empty(f_to)) @@ -4453,9 +4450,6 @@ SYSCALL_DEFINE5(move_mount, uflags = AT_EMPTY_PATH; from_name = getname_maybe_null(from_pathname, uflags); - if (IS_ERR(from_name)) - return PTR_ERR(from_name); - if (!from_name && from_dfd >= 0) { CLASS(fd_raw, f_from)(from_dfd); if (fd_empty(f_from)) From edefe6bda719d49384b22c524ef8102ce9c632e9 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 31 Oct 2025 01:12:04 -0400 Subject: [PATCH 28/68] ksmbd_vfs_path_lookup(): vfs_path_parent_lookup() accepts ERR_PTR() as name no need to check in the caller Signed-off-by: Al Viro --- fs/smb/server/vfs.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c index f891344bd76b..a97226116840 100644 --- a/fs/smb/server/vfs.c +++ b/fs/smb/server/vfs.c @@ -67,9 +67,6 @@ static int ksmbd_vfs_path_lookup(struct ksmbd_share_config *share_conf, } filename = getname_kernel(pathname); - if (IS_ERR(filename)) - return PTR_ERR(filename); - err = vfs_path_parent_lookup(filename, flags, path, &last, &type, root_share_path); From ba33ac100d3feb1efb43b32e63cc0c6430936aa3 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 31 Oct 2025 01:13:32 -0400 Subject: [PATCH 29/68] ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as name no need to check in the caller Signed-off-by: Al Viro --- fs/smb/server/vfs.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c index a97226116840..30b65b667b96 100644 --- a/fs/smb/server/vfs.c +++ b/fs/smb/server/vfs.c @@ -674,10 +674,6 @@ int ksmbd_vfs_rename(struct ksmbd_work *work, const struct path *old_path, return -ENOMEM; to = getname_kernel(newname); - if (IS_ERR(to)) { - err = PTR_ERR(to); - goto revert_fsids; - } retry: err = vfs_path_parent_lookup(to, lookup_flags | LOOKUP_BENEATH, @@ -737,7 +733,6 @@ out2: } out1: putname(to); -revert_fsids: ksmbd_revert_fsids(work); return err; } From 2e2d64aea5c59ba976fced4bf44832ea425a3f3f Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 25 Sep 2025 17:02:28 -0400 Subject: [PATCH 30/68] do_filp_open(): DTRT when getting ERR_PTR() as pathname The rest of the set_nameidata() callers treat IS_ERR(pathname) as "bail out immediately with PTR_ERR(pathname) as error". Makes life simpler for callers; do_filp_open() is the only exception and its callers would also benefit from such calling conventions change. Signed-off-by: Al Viro --- fs/namei.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/namei.c b/fs/namei.c index f4359825ba48..659c92a6d52c 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -4871,6 +4871,8 @@ struct file *do_filp_open(int dfd, struct filename *pathname, int flags = op->lookup_flags; struct file *filp; + if (IS_ERR(pathname)) + return ERR_CAST(pathname); set_nameidata(&nd, dfd, pathname, NULL); filp = path_openat(&nd, op, flags | LOOKUP_RCU); if (unlikely(filp == ERR_PTR(-ECHILD))) From 541003b576c3e3c328314398a6df76eb3cebf847 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 28 Oct 2025 00:11:45 -0400 Subject: [PATCH 31/68] rename do_filp_open() to do_file_open() "filp" thing never made sense; seeing that there are exactly 4 callers in the entire tree (and it's neither exported nor even declared in linux/*/*.h), there's no point keeping that ugliness. FWIW, the 'filp' thing did originate in OSD&I; for some reason Tanenbaum decided to call the object representing an opened file 'struct filp', the last letter standing for 'position'. In all Unices, Linux included, the corresponding object had always been 'struct file'... Signed-off-by: Al Viro --- fs/exec.c | 2 +- fs/internal.h | 2 +- fs/namei.c | 2 +- fs/open.c | 4 ++-- io_uring/openclose.c | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 9d5ebc9d15b0..b7d8081d12ea 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -780,7 +780,7 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags) if (flags & AT_EMPTY_PATH) open_exec_flags.lookup_flags |= LOOKUP_EMPTY; - file = do_filp_open(fd, name, &open_exec_flags); + file = do_file_open(fd, name, &open_exec_flags); if (IS_ERR(file)) return file; diff --git a/fs/internal.h b/fs/internal.h index c7a34412399e..4c4d2733c47a 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -190,7 +190,7 @@ struct open_flags { int intent; int lookup_flags; }; -extern struct file *do_filp_open(int dfd, struct filename *pathname, +extern struct file *do_file_open(int dfd, struct filename *pathname, const struct open_flags *op); extern struct file *do_file_open_root(const struct path *, const char *, const struct open_flags *); diff --git a/fs/namei.c b/fs/namei.c index 659c92a6d52c..65a06fb312af 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -4864,7 +4864,7 @@ static struct file *path_openat(struct nameidata *nd, return ERR_PTR(error); } -struct file *do_filp_open(int dfd, struct filename *pathname, +struct file *do_file_open(int dfd, struct filename *pathname, const struct open_flags *op) { struct nameidata nd; diff --git a/fs/open.c b/fs/open.c index 2fea68991d42..3d2e2a2554c5 100644 --- a/fs/open.c +++ b/fs/open.c @@ -1382,7 +1382,7 @@ struct file *file_open_name(struct filename *name, int flags, umode_t mode) int err = build_open_flags(&how, &op); if (err) return ERR_PTR(err); - return do_filp_open(AT_FDCWD, name, &op); + return do_file_open(AT_FDCWD, name, &op); } /** @@ -1436,7 +1436,7 @@ static int do_sys_openat2(int dfd, const char __user *filename, if (IS_ERR(tmp)) return PTR_ERR(tmp); - return FD_ADD(how->flags, do_filp_open(dfd, tmp, &op)); + return FD_ADD(how->flags, do_file_open(dfd, tmp, &op)); } int do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode) diff --git a/io_uring/openclose.c b/io_uring/openclose.c index aa3acb06247f..c09dd14108ed 100644 --- a/io_uring/openclose.c +++ b/io_uring/openclose.c @@ -138,7 +138,7 @@ int io_openat2(struct io_kiocb *req, unsigned int issue_flags) goto err; } - file = do_filp_open(open->dfd, name, &op); + file = do_file_open(open->dfd, name, &op); if (IS_ERR(file)) { /* * We could hang on to this 'fd' on retrying, but seems like From 151e3257d61941ac07a7daacdb66ddc645f6ca34 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 28 Oct 2025 00:11:45 -0400 Subject: [PATCH 32/68] do_sys_openat2(): get rid of useless check, switch to CLASS(filename) do_file_open() will do the right thing when given ERR_PTR() as name... Signed-off-by: Al Viro --- fs/open.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/fs/open.c b/fs/open.c index 3d2e2a2554c5..ac8dedea8daf 100644 --- a/fs/open.c +++ b/fs/open.c @@ -1425,18 +1425,12 @@ static int do_sys_openat2(int dfd, const char __user *filename, struct open_how *how) { struct open_flags op; - struct filename *tmp __free(putname) = NULL; - int err; - - err = build_open_flags(how, &op); + int err = build_open_flags(how, &op); if (unlikely(err)) return err; - tmp = getname(filename); - if (IS_ERR(tmp)) - return PTR_ERR(tmp); - - return FD_ADD(how->flags, do_file_open(dfd, tmp, &op)); + CLASS(filename, name)(filename); + return FD_ADD(how->flags, do_file_open(dfd, name, &op)); } int do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode) From 47b3b9bf93ec66ec2443f553c22e12e0475f1395 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 25 Sep 2025 17:11:36 -0400 Subject: [PATCH 33/68] simplify the callers of file_open_name() It accepts ERR_PTR() for name and does the right thing in that case. That allows to simplify the logics in callers, making them trivial to switch to CLASS(filename). Signed-off-by: Al Viro --- fs/open.c | 10 ++-------- kernel/acct.c | 4 +--- mm/huge_memory.c | 15 +++------------ mm/swapfile.c | 21 +++------------------ 4 files changed, 9 insertions(+), 41 deletions(-) diff --git a/fs/open.c b/fs/open.c index ac8dedea8daf..7254eda9f4a5 100644 --- a/fs/open.c +++ b/fs/open.c @@ -1398,14 +1398,8 @@ struct file *file_open_name(struct filename *name, int flags, umode_t mode) */ struct file *filp_open(const char *filename, int flags, umode_t mode) { - struct filename *name = getname_kernel(filename); - struct file *file = ERR_CAST(name); - - if (!IS_ERR(name)) { - file = file_open_name(name, flags, mode); - putname(name); - } - return file; + CLASS(filename_kernel, name)(filename); + return file_open_name(name, flags, mode); } EXPORT_SYMBOL(filp_open); diff --git a/kernel/acct.c b/kernel/acct.c index 2a2b3c874acd..812808e5b1b8 100644 --- a/kernel/acct.c +++ b/kernel/acct.c @@ -218,7 +218,6 @@ static int acct_on(const char __user *name) /* Difference from BSD - they don't do O_APPEND */ const int open_flags = O_WRONLY|O_APPEND|O_LARGEFILE; struct pid_namespace *ns = task_active_pid_ns(current); - struct filename *pathname __free(putname) = getname(name); struct file *original_file __free(fput) = NULL; // in that order struct path internal __free(path_put) = {}; // in that order struct file *file __free(fput_sync) = NULL; // in that order @@ -226,8 +225,7 @@ static int acct_on(const char __user *name) struct vfsmount *mnt; struct fs_pin *old; - if (IS_ERR(pathname)) - return PTR_ERR(pathname); + CLASS(filename, pathname)(name); original_file = file_open_name(pathname, open_flags, 0); if (IS_ERR(original_file)) return PTR_ERR(original_file); diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 40cf59301c21..a6d37902b73d 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -4692,23 +4692,18 @@ static int split_huge_pages_in_file(const char *file_path, pgoff_t off_start, pgoff_t off_end, unsigned int new_order, long in_folio_offset) { - struct filename *file; struct file *candidate; struct address_space *mapping; - int ret = -EINVAL; pgoff_t index; int nr_pages = 1; unsigned long total = 0, split = 0; unsigned int min_order; unsigned int target_order; - file = getname_kernel(file_path); - if (IS_ERR(file)) - return ret; - + CLASS(filename_kernel, file)(file_path); candidate = file_open_name(file, O_RDONLY, 0); if (IS_ERR(candidate)) - goto out; + return -EINVAL; pr_debug("split file-backed THPs in file: %s, page offset: [0x%lx - 0x%lx], new_order: %u, in_folio_offset: %ld\n", file_path, off_start, off_end, new_order, in_folio_offset); @@ -4757,12 +4752,8 @@ next: } filp_close(candidate, NULL); - ret = 0; - pr_debug("%lu of %lu file-backed THP split\n", split, total); -out: - putname(file); - return ret; + return 0; } #define MAX_INPUT_BUF_SZ 255 diff --git a/mm/swapfile.c b/mm/swapfile.c index 46d2008e4b99..25120cf7c480 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -2831,7 +2831,6 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) struct file *swap_file, *victim; struct address_space *mapping; struct inode *inode; - struct filename *pathname; unsigned int maxpages; int err, found = 0; @@ -2840,14 +2839,10 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) BUG_ON(!current->mm); - pathname = getname(specialfile); - if (IS_ERR(pathname)) - return PTR_ERR(pathname); - + CLASS(filename, pathname)(specialfile); victim = file_open_name(pathname, O_RDWR|O_LARGEFILE, 0); - err = PTR_ERR(victim); if (IS_ERR(victim)) - goto out; + return PTR_ERR(victim); mapping = victim->f_mapping; spin_lock(&swap_lock); @@ -2964,8 +2959,6 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) out_dput: filp_close(victim, NULL); -out: - putname(pathname); return err; } @@ -3392,7 +3385,6 @@ err: SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) { struct swap_info_struct *si; - struct filename *name; struct file *swap_file = NULL; struct address_space *mapping; struct dentry *dentry; @@ -3422,12 +3414,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) INIT_WORK(&si->discard_work, swap_discard_work); INIT_WORK(&si->reclaim_work, swap_reclaim_work); - name = getname(specialfile); - if (IS_ERR(name)) { - error = PTR_ERR(name); - name = NULL; - goto bad_swap; - } + CLASS(filename, name)(specialfile); swap_file = file_open_name(name, O_RDWR | O_LARGEFILE | O_EXCL, 0); if (IS_ERR(swap_file)) { error = PTR_ERR(swap_file); @@ -3635,8 +3622,6 @@ bad_swap: out: if (!IS_ERR_OR_NULL(folio)) folio_release_kmap(folio, swap_header); - if (name) - putname(name); if (inode) inode_unlock(inode); return error; From 2c941f26c6abc032fd7800ac7dcbfaf3cb586e21 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 25 Sep 2025 17:14:20 -0400 Subject: [PATCH 34/68] simplify the callers of do_open_execat() Signed-off-by: Al Viro --- fs/exec.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index b7d8081d12ea..5b4110c7522e 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -815,14 +815,8 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags) */ struct file *open_exec(const char *name) { - struct filename *filename = getname_kernel(name); - struct file *f = ERR_CAST(filename); - - if (!IS_ERR(filename)) { - f = do_open_execat(AT_FDCWD, filename, 0); - putname(filename); - } - return f; + CLASS(filename_kernel, filename)(name); + return do_open_execat(AT_FDCWD, filename, 0); } EXPORT_SYMBOL(open_exec); From bb850584aaa2f31bc6c494f973047a325961b333 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 25 Sep 2025 17:18:42 -0400 Subject: [PATCH 35/68] simplify the callers of alloc_bprm() alloc_bprm() starts with do_open_execat() and it will do the right thing if given ERR_PTR() for name. Allows to drop such checks in its callers... Signed-off-by: Al Viro --- fs/exec.c | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 5b4110c7522e..1473e8c06a8c 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1782,9 +1782,6 @@ static int do_execveat_common(int fd, struct filename *filename, struct linux_binprm *bprm; int retval; - if (IS_ERR(filename)) - return PTR_ERR(filename); - /* * We move the actual failure in case of RLIMIT_NPROC excess from * set*uid() to execve() because too many poorly written programs @@ -1862,7 +1859,6 @@ out_ret: int kernel_execve(const char *kernel_filename, const char *const *argv, const char *const *envp) { - struct filename *filename; struct linux_binprm *bprm; int fd = AT_FDCWD; int retval; @@ -1871,15 +1867,10 @@ int kernel_execve(const char *kernel_filename, if (WARN_ON_ONCE(current->flags & PF_KTHREAD)) return -EINVAL; - filename = getname_kernel(kernel_filename); - if (IS_ERR(filename)) - return PTR_ERR(filename); - + CLASS(filename_kernel, filename)(kernel_filename); bprm = alloc_bprm(fd, filename, 0); - if (IS_ERR(bprm)) { - retval = PTR_ERR(bprm); - goto out_ret; - } + if (IS_ERR(bprm)) + return PTR_ERR(bprm); retval = count_strings_kernel(argv); if (WARN_ON_ONCE(retval == 0)) @@ -1913,8 +1904,6 @@ int kernel_execve(const char *kernel_filename, retval = bprm_execve(bprm); out_free: free_bprm(bprm); -out_ret: - putname(filename); return retval; } From 88b33614f9ca09a0f6471b1790f5f718d01d84a6 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 7 Jan 2026 15:16:24 -0500 Subject: [PATCH 36/68] execve: fold {compat_,}do_execve{,at}() into their sole callers All of them are wrappers for do_execveat_common() and each has exactly one caller. The only difference is in the way they are constructing argv/envp arguments for do_execveat_common() and that's easy to do with less boilerplate. Signed-off-by: Al Viro --- fs/exec.c | 80 +++++++++++++------------------------------------------ 1 file changed, 19 insertions(+), 61 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 1473e8c06a8c..5d15c0440c3d 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1907,59 +1907,6 @@ out_free: return retval; } -static int do_execve(struct filename *filename, - const char __user *const __user *__argv, - const char __user *const __user *__envp) -{ - struct user_arg_ptr argv = { .ptr.native = __argv }; - struct user_arg_ptr envp = { .ptr.native = __envp }; - return do_execveat_common(AT_FDCWD, filename, argv, envp, 0); -} - -static int do_execveat(int fd, struct filename *filename, - const char __user *const __user *__argv, - const char __user *const __user *__envp, - int flags) -{ - struct user_arg_ptr argv = { .ptr.native = __argv }; - struct user_arg_ptr envp = { .ptr.native = __envp }; - - return do_execveat_common(fd, filename, argv, envp, flags); -} - -#ifdef CONFIG_COMPAT -static int compat_do_execve(struct filename *filename, - const compat_uptr_t __user *__argv, - const compat_uptr_t __user *__envp) -{ - struct user_arg_ptr argv = { - .is_compat = true, - .ptr.compat = __argv, - }; - struct user_arg_ptr envp = { - .is_compat = true, - .ptr.compat = __envp, - }; - return do_execveat_common(AT_FDCWD, filename, argv, envp, 0); -} - -static int compat_do_execveat(int fd, struct filename *filename, - const compat_uptr_t __user *__argv, - const compat_uptr_t __user *__envp, - int flags) -{ - struct user_arg_ptr argv = { - .is_compat = true, - .ptr.compat = __argv, - }; - struct user_arg_ptr envp = { - .is_compat = true, - .ptr.compat = __envp, - }; - return do_execveat_common(fd, filename, argv, envp, flags); -} -#endif - void set_binfmt(struct linux_binfmt *new) { struct mm_struct *mm = current->mm; @@ -1984,12 +1931,18 @@ void set_dumpable(struct mm_struct *mm, int value) __mm_flags_set_mask_dumpable(mm, value); } +static inline struct user_arg_ptr native_arg(const char __user *const __user *p) +{ + return (struct user_arg_ptr){.ptr.native = p}; +} + SYSCALL_DEFINE3(execve, const char __user *, filename, const char __user *const __user *, argv, const char __user *const __user *, envp) { - return do_execve(getname(filename), argv, envp); + return do_execveat_common(AT_FDCWD, getname(filename), + native_arg(argv), native_arg(envp), 0); } SYSCALL_DEFINE5(execveat, @@ -1998,17 +1951,23 @@ SYSCALL_DEFINE5(execveat, const char __user *const __user *, envp, int, flags) { - return do_execveat(fd, - getname_uflags(filename, flags), - argv, envp, flags); + return do_execveat_common(fd, getname_uflags(filename, flags), + native_arg(argv), native_arg(envp), flags); } #ifdef CONFIG_COMPAT + +static inline struct user_arg_ptr compat_arg(const compat_uptr_t __user *p) +{ + return (struct user_arg_ptr){.is_compat = true, .ptr.compat = p}; +} + COMPAT_SYSCALL_DEFINE3(execve, const char __user *, filename, const compat_uptr_t __user *, argv, const compat_uptr_t __user *, envp) { - return compat_do_execve(getname(filename), argv, envp); + return do_execveat_common(AT_FDCWD, getname(filename), + compat_arg(argv), compat_arg(envp), 0); } COMPAT_SYSCALL_DEFINE5(execveat, int, fd, @@ -2017,9 +1976,8 @@ COMPAT_SYSCALL_DEFINE5(execveat, int, fd, const compat_uptr_t __user *, envp, int, flags) { - return compat_do_execveat(fd, - getname_uflags(filename, flags), - argv, envp, flags); + return do_execveat_common(fd, getname_uflags(filename, flags), + compat_arg(argv), compat_arg(envp), flags); } #endif From 194c760b6acd214e47f2504cede9a9dbadd8fcba Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 7 Jan 2026 15:20:45 -0500 Subject: [PATCH 37/68] do_execveat_common(): don't consume filename reference ... and convert its callers to CLASS(filename...) Signed-off-by: Al Viro --- fs/exec.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 5d15c0440c3d..9e799af13602 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1789,20 +1789,16 @@ static int do_execveat_common(int fd, struct filename *filename, * whether NPROC limit is still exceeded. */ if ((current->flags & PF_NPROC_EXCEEDED) && - is_rlimit_overlimit(current_ucounts(), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) { - retval = -EAGAIN; - goto out_ret; - } + is_rlimit_overlimit(current_ucounts(), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) + return -EAGAIN; /* We're below the limit (still or again), so we don't want to make * further execve() calls fail. */ current->flags &= ~PF_NPROC_EXCEEDED; bprm = alloc_bprm(fd, filename, flags); - if (IS_ERR(bprm)) { - retval = PTR_ERR(bprm); - goto out_ret; - } + if (IS_ERR(bprm)) + return PTR_ERR(bprm); retval = count(argv, MAX_ARG_STRINGS); if (retval < 0) @@ -1850,9 +1846,6 @@ static int do_execveat_common(int fd, struct filename *filename, retval = bprm_execve(bprm); out_free: free_bprm(bprm); - -out_ret: - putname(filename); return retval; } @@ -1941,7 +1934,8 @@ SYSCALL_DEFINE3(execve, const char __user *const __user *, argv, const char __user *const __user *, envp) { - return do_execveat_common(AT_FDCWD, getname(filename), + CLASS(filename, name)(filename); + return do_execveat_common(AT_FDCWD, name, native_arg(argv), native_arg(envp), 0); } @@ -1951,7 +1945,8 @@ SYSCALL_DEFINE5(execveat, const char __user *const __user *, envp, int, flags) { - return do_execveat_common(fd, getname_uflags(filename, flags), + CLASS(filename_uflags, name)(filename, flags); + return do_execveat_common(fd, name, native_arg(argv), native_arg(envp), flags); } @@ -1966,7 +1961,8 @@ COMPAT_SYSCALL_DEFINE3(execve, const char __user *, filename, const compat_uptr_t __user *, argv, const compat_uptr_t __user *, envp) { - return do_execveat_common(AT_FDCWD, getname(filename), + CLASS(filename, name)(filename); + return do_execveat_common(AT_FDCWD, name, compat_arg(argv), compat_arg(envp), 0); } @@ -1976,7 +1972,8 @@ COMPAT_SYSCALL_DEFINE5(execveat, int, fd, const compat_uptr_t __user *, envp, int, flags) { - return do_execveat_common(fd, getname_uflags(filename, flags), + CLASS(filename_uflags, name)(filename, flags); + return do_execveat_common(fd, name, compat_arg(argv), compat_arg(envp), flags); } #endif From 0697b4f400696c1311cbd14421698b340dd8f7d4 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 28 Oct 2025 02:29:04 -0400 Subject: [PATCH 38/68] switch {alloc,free}_bprm() to CLASS() All linux_binprm instances come from alloc_bprm() and are unconditionally destroyed by free_bprm() in the end of the same scope. IOW, CLASS() machinery is a decent fit for those. Signed-off-by: Al Viro --- fs/exec.c | 48 +++++++++++++++++++++--------------------------- 1 file changed, 21 insertions(+), 27 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 9e799af13602..5dd8ff61f27a 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1465,6 +1465,9 @@ out_free: return ERR_PTR(retval); } +DEFINE_CLASS(bprm, struct linux_binprm *, if (!IS_ERR(_T)) free_bprm(_T), + alloc_bprm(fd, name, flags), int fd, struct filename *name, int flags) + int bprm_change_interp(const char *interp, struct linux_binprm *bprm) { /* If a binfmt changed the interp, free it first. */ @@ -1779,7 +1782,6 @@ static int do_execveat_common(int fd, struct filename *filename, struct user_arg_ptr envp, int flags) { - struct linux_binprm *bprm; int retval; /* @@ -1796,36 +1798,36 @@ static int do_execveat_common(int fd, struct filename *filename, * further execve() calls fail. */ current->flags &= ~PF_NPROC_EXCEEDED; - bprm = alloc_bprm(fd, filename, flags); + CLASS(bprm, bprm)(fd, filename, flags); if (IS_ERR(bprm)) return PTR_ERR(bprm); retval = count(argv, MAX_ARG_STRINGS); if (retval < 0) - goto out_free; + return retval; bprm->argc = retval; retval = count(envp, MAX_ARG_STRINGS); if (retval < 0) - goto out_free; + return retval; bprm->envc = retval; retval = bprm_stack_limits(bprm); if (retval < 0) - goto out_free; + return retval; retval = copy_string_kernel(bprm->filename, bprm); if (retval < 0) - goto out_free; + return retval; bprm->exec = bprm->p; retval = copy_strings(bprm->envc, envp, bprm); if (retval < 0) - goto out_free; + return retval; retval = copy_strings(bprm->argc, argv, bprm); if (retval < 0) - goto out_free; + return retval; /* * When argv is empty, add an empty string ("") as argv[0] to @@ -1836,24 +1838,19 @@ static int do_execveat_common(int fd, struct filename *filename, if (bprm->argc == 0) { retval = copy_string_kernel("", bprm); if (retval < 0) - goto out_free; + return retval; bprm->argc = 1; pr_warn_once("process '%s' launched '%s' with NULL argv: empty string added\n", current->comm, bprm->filename); } - retval = bprm_execve(bprm); -out_free: - free_bprm(bprm); - return retval; + return bprm_execve(bprm); } int kernel_execve(const char *kernel_filename, const char *const *argv, const char *const *envp) { - struct linux_binprm *bprm; - int fd = AT_FDCWD; int retval; /* It is non-sense for kernel threads to call execve */ @@ -1861,43 +1858,40 @@ int kernel_execve(const char *kernel_filename, return -EINVAL; CLASS(filename_kernel, filename)(kernel_filename); - bprm = alloc_bprm(fd, filename, 0); + CLASS(bprm, bprm)(AT_FDCWD, filename, 0); if (IS_ERR(bprm)) return PTR_ERR(bprm); retval = count_strings_kernel(argv); if (WARN_ON_ONCE(retval == 0)) - retval = -EINVAL; + return -EINVAL; if (retval < 0) - goto out_free; + return retval; bprm->argc = retval; retval = count_strings_kernel(envp); if (retval < 0) - goto out_free; + return retval; bprm->envc = retval; retval = bprm_stack_limits(bprm); if (retval < 0) - goto out_free; + return retval; retval = copy_string_kernel(bprm->filename, bprm); if (retval < 0) - goto out_free; + return retval; bprm->exec = bprm->p; retval = copy_strings_kernel(bprm->envc, envp, bprm); if (retval < 0) - goto out_free; + return retval; retval = copy_strings_kernel(bprm->argc, argv, bprm); if (retval < 0) - goto out_free; + return retval; - retval = bprm_execve(bprm); -out_free: - free_bprm(bprm); - return retval; + return bprm_execve(bprm); } void set_binfmt(struct linux_binfmt *new) From e6d50234ccb9ff54addd579032a146aef52e7541 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 6 Jan 2026 23:19:10 -0500 Subject: [PATCH 39/68] non-consuming variant of do_renameat2() filename_renameat2() replaces do_renameat2(); unlike the latter, it does not drop filename references - these days it can be just as easily arranged in the caller. Signed-off-by: Al Viro --- Documentation/filesystems/porting.rst | 9 ++++++++ fs/internal.h | 2 +- fs/namei.c | 30 +++++++++++++-------------- io_uring/fs.c | 7 ++++--- 4 files changed, 29 insertions(+), 19 deletions(-) diff --git a/Documentation/filesystems/porting.rst b/Documentation/filesystems/porting.rst index 3397937ed838..459ec2f57794 100644 --- a/Documentation/filesystems/porting.rst +++ b/Documentation/filesystems/porting.rst @@ -1334,3 +1334,12 @@ end_creating() and the parent will be unlocked precisely when necessary. kill_litter_super() is gone; convert to DCACHE_PERSISTENT use (as all in-tree filesystems have done). + +--- + +**mandatory** + +fs/namei.c primitives that consume filesystem references (do_renameat2(), +do_linkat(), do_symlinkat(), do_mkdirat(), do_mknodat(), do_unlinkat() +and do_rmdir()) are getting replaced with non-consuming analogues +(filename_renameat2(), etc.) Replaced so far: do_renameat2(). diff --git a/fs/internal.h b/fs/internal.h index 4c4d2733c47a..5047cfbb8c93 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -57,7 +57,7 @@ extern int filename_lookup(int dfd, struct filename *name, unsigned flags, int do_rmdir(int dfd, struct filename *name); int do_unlinkat(int dfd, struct filename *name); int may_linkat(struct mnt_idmap *idmap, const struct path *link); -int do_renameat2(int olddfd, struct filename *oldname, int newdfd, +int filename_renameat2(int olddfd, struct filename *oldname, int newdfd, struct filename *newname, unsigned int flags); int do_mkdirat(int dfd, struct filename *name, umode_t mode); int do_mknodat(int dfd, struct filename *name, umode_t mode, unsigned int dev); diff --git a/fs/namei.c b/fs/namei.c index 65a06fb312af..5354f240b86a 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -6028,8 +6028,8 @@ out: } EXPORT_SYMBOL(vfs_rename); -int do_renameat2(int olddfd, struct filename *from, int newdfd, - struct filename *to, unsigned int flags) +int filename_renameat2(int olddfd, struct filename *from, + int newdfd, struct filename *to, unsigned int flags) { struct renamedata rd; struct path old_path, new_path; @@ -6038,20 +6038,20 @@ int do_renameat2(int olddfd, struct filename *from, int newdfd, struct delegated_inode delegated_inode = { }; unsigned int lookup_flags = 0; bool should_retry = false; - int error = -EINVAL; + int error; if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT)) - goto put_names; + return -EINVAL; if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) && (flags & RENAME_EXCHANGE)) - goto put_names; + return -EINVAL; retry: error = filename_parentat(olddfd, from, lookup_flags, &old_path, &old_last, &old_type); if (error) - goto put_names; + return error; error = filename_parentat(newdfd, to, lookup_flags, &new_path, &new_last, &new_type); @@ -6128,30 +6128,30 @@ exit1: lookup_flags |= LOOKUP_REVAL; goto retry; } -put_names: - putname(from); - putname(to); return error; } SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname, int, newdfd, const char __user *, newname, unsigned int, flags) { - return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname), - flags); + CLASS(filename, old)(oldname); + CLASS(filename, new)(newname); + return filename_renameat2(olddfd, old, newdfd, new, flags); } SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, int, newdfd, const char __user *, newname) { - return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname), - 0); + CLASS(filename, old)(oldname); + CLASS(filename, new)(newname); + return filename_renameat2(olddfd, old, newdfd, new, 0); } SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname) { - return do_renameat2(AT_FDCWD, getname(oldname), AT_FDCWD, - getname(newname), 0); + CLASS(filename, old)(oldname); + CLASS(filename, new)(newname); + return filename_renameat2(AT_FDCWD, old, AT_FDCWD, new, 0); } int readlink_copy(char __user *buffer, int buflen, const char *link, int linklen) diff --git a/io_uring/fs.c b/io_uring/fs.c index c04c6282210a..e5829d112c9e 100644 --- a/io_uring/fs.c +++ b/io_uring/fs.c @@ -82,13 +82,14 @@ int io_renameat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) int io_renameat(struct io_kiocb *req, unsigned int issue_flags) { struct io_rename *ren = io_kiocb_to_cmd(req, struct io_rename); + CLASS(filename_complete_delayed, old)(&ren->oldpath); + CLASS(filename_complete_delayed, new)(&ren->newpath); int ret; WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); - ret = do_renameat2(ren->old_dfd, complete_getname(&ren->oldpath), - ren->new_dfd, complete_getname(&ren->newpath), - ren->flags); + ret = filename_renameat2(ren->old_dfd, old, + ren->new_dfd, new, ren->flags); req->flags &= ~REQ_F_NEED_CLEANUP; io_req_set_res(req, ret, 0); From 037193b0ae833c922881f0bf188b4ed49874e6c9 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 6 Jan 2026 23:23:05 -0500 Subject: [PATCH 40/68] non-consuming variant of do_linkat() similar to previous commit; replacement is filename_linkat() Signed-off-by: Al Viro --- Documentation/filesystems/porting.rst | 2 +- fs/init.c | 5 +++-- fs/internal.h | 2 +- fs/namei.c | 27 ++++++++++++--------------- io_uring/fs.c | 5 +++-- 5 files changed, 20 insertions(+), 21 deletions(-) diff --git a/Documentation/filesystems/porting.rst b/Documentation/filesystems/porting.rst index 459ec2f57794..e93ba90e3e4f 100644 --- a/Documentation/filesystems/porting.rst +++ b/Documentation/filesystems/porting.rst @@ -1342,4 +1342,4 @@ in-tree filesystems have done). fs/namei.c primitives that consume filesystem references (do_renameat2(), do_linkat(), do_symlinkat(), do_mkdirat(), do_mknodat(), do_unlinkat() and do_rmdir()) are getting replaced with non-consuming analogues -(filename_renameat2(), etc.) Replaced so far: do_renameat2(). +(filename_renameat2(), etc.) Replaced so far: do_renameat2(), do_linkat(). diff --git a/fs/init.c b/fs/init.c index da6500d2ee98..f46e54552931 100644 --- a/fs/init.c +++ b/fs/init.c @@ -145,8 +145,9 @@ int __init init_mknod(const char *filename, umode_t mode, unsigned int dev) int __init init_link(const char *oldname, const char *newname) { - return do_linkat(AT_FDCWD, getname_kernel(oldname), - AT_FDCWD, getname_kernel(newname), 0); + CLASS(filename_kernel, old)(oldname); + CLASS(filename_kernel, new)(newname); + return filename_linkat(AT_FDCWD, old, AT_FDCWD, new, 0); } int __init init_symlink(const char *oldname, const char *newname) diff --git a/fs/internal.h b/fs/internal.h index 5047cfbb8c93..c9b70c2716d1 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -62,7 +62,7 @@ int filename_renameat2(int olddfd, struct filename *oldname, int newdfd, int do_mkdirat(int dfd, struct filename *name, umode_t mode); int do_mknodat(int dfd, struct filename *name, umode_t mode, unsigned int dev); int do_symlinkat(struct filename *from, int newdfd, struct filename *to); -int do_linkat(int olddfd, struct filename *old, int newdfd, +int filename_linkat(int olddfd, struct filename *old, int newdfd, struct filename *new, int flags); int vfs_tmpfile(struct mnt_idmap *idmap, const struct path *parentpath, diff --git a/fs/namei.c b/fs/namei.c index 5354f240b86a..e5d494610c2c 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -5729,9 +5729,9 @@ EXPORT_SYMBOL(vfs_link); * We don't follow them on the oldname either to be compatible * with linux 2.0, and to avoid hard-linking to directories * and other special files. --ADM - */ -int do_linkat(int olddfd, struct filename *old, int newdfd, - struct filename *new, int flags) +*/ +int filename_linkat(int olddfd, struct filename *old, + int newdfd, struct filename *new, int flags) { struct mnt_idmap *idmap; struct dentry *new_dentry; @@ -5740,10 +5740,8 @@ int do_linkat(int olddfd, struct filename *old, int newdfd, int how = 0; int error; - if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) { - error = -EINVAL; - goto out_putnames; - } + if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) + return -EINVAL; /* * To use null names we require CAP_DAC_READ_SEARCH or * that the open-time creds of the dfd matches current. @@ -5758,7 +5756,7 @@ int do_linkat(int olddfd, struct filename *old, int newdfd, retry: error = filename_lookup(olddfd, old, how, &old_path, NULL); if (error) - goto out_putnames; + return error; new_dentry = filename_create(newdfd, new, &new_path, (how & LOOKUP_REVAL)); @@ -5794,23 +5792,22 @@ out_dput: } out_putpath: path_put(&old_path); -out_putnames: - putname(old); - putname(new); - return error; } SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, int, newdfd, const char __user *, newname, int, flags) { - return do_linkat(olddfd, getname_uflags(oldname, flags), - newdfd, getname(newname), flags); + CLASS(filename_uflags, old)(oldname, flags); + CLASS(filename, new)(newname); + return filename_linkat(olddfd, old, newdfd, new, flags); } SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname) { - return do_linkat(AT_FDCWD, getname(oldname), AT_FDCWD, getname(newname), 0); + CLASS(filename, old)(oldname); + CLASS(filename, new)(newname); + return filename_linkat(AT_FDCWD, old, AT_FDCWD, new, 0); } /** diff --git a/io_uring/fs.c b/io_uring/fs.c index e5829d112c9e..e39cd1ca1942 100644 --- a/io_uring/fs.c +++ b/io_uring/fs.c @@ -280,12 +280,13 @@ int io_linkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) int io_linkat(struct io_kiocb *req, unsigned int issue_flags) { struct io_link *lnk = io_kiocb_to_cmd(req, struct io_link); + CLASS(filename_complete_delayed, old)(&lnk->oldpath); + CLASS(filename_complete_delayed, new)(&lnk->newpath); int ret; WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); - ret = do_linkat(lnk->old_dfd, complete_getname(&lnk->oldpath), - lnk->new_dfd, complete_getname(&lnk->newpath), lnk->flags); + ret = filename_linkat(lnk->old_dfd, old, lnk->new_dfd, new, lnk->flags); req->flags &= ~REQ_F_NEED_CLEANUP; io_req_set_res(req, ret, 0); From da72b76aaeaa2bc67ccedd6e539fabc04aff3ecd Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 6 Jan 2026 23:26:43 -0500 Subject: [PATCH 41/68] non-consuming variant of do_symlinkat() similar to previous commit; replacement is filename_symlinkat() Signed-off-by: Al Viro --- Documentation/filesystems/porting.rst | 3 ++- fs/init.c | 5 +++-- fs/internal.h | 2 +- fs/namei.c | 23 +++++++++++------------ io_uring/fs.c | 5 +++-- 5 files changed, 20 insertions(+), 18 deletions(-) diff --git a/Documentation/filesystems/porting.rst b/Documentation/filesystems/porting.rst index e93ba90e3e4f..bb526ae9a1d7 100644 --- a/Documentation/filesystems/porting.rst +++ b/Documentation/filesystems/porting.rst @@ -1342,4 +1342,5 @@ in-tree filesystems have done). fs/namei.c primitives that consume filesystem references (do_renameat2(), do_linkat(), do_symlinkat(), do_mkdirat(), do_mknodat(), do_unlinkat() and do_rmdir()) are getting replaced with non-consuming analogues -(filename_renameat2(), etc.) Replaced so far: do_renameat2(), do_linkat(). +(filename_renameat2(), etc.) Replaced so far: do_renameat2(), do_linkat(), +do_symlinkat(). diff --git a/fs/init.c b/fs/init.c index f46e54552931..a54ef750ffe3 100644 --- a/fs/init.c +++ b/fs/init.c @@ -152,8 +152,9 @@ int __init init_link(const char *oldname, const char *newname) int __init init_symlink(const char *oldname, const char *newname) { - return do_symlinkat(getname_kernel(oldname), AT_FDCWD, - getname_kernel(newname)); + CLASS(filename_kernel, old)(oldname); + CLASS(filename_kernel, new)(newname); + return filename_symlinkat(old, AT_FDCWD, new); } int __init init_unlink(const char *pathname) diff --git a/fs/internal.h b/fs/internal.h index c9b70c2716d1..4a63b89c02d7 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -61,7 +61,7 @@ int filename_renameat2(int olddfd, struct filename *oldname, int newdfd, struct filename *newname, unsigned int flags); int do_mkdirat(int dfd, struct filename *name, umode_t mode); int do_mknodat(int dfd, struct filename *name, umode_t mode, unsigned int dev); -int do_symlinkat(struct filename *from, int newdfd, struct filename *to); +int filename_symlinkat(struct filename *from, int newdfd, struct filename *to); int filename_linkat(int olddfd, struct filename *old, int newdfd, struct filename *new, int flags); int vfs_tmpfile(struct mnt_idmap *idmap, diff --git a/fs/namei.c b/fs/namei.c index e5d494610c2c..c88ad27f66c7 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -5581,7 +5581,7 @@ int vfs_symlink(struct mnt_idmap *idmap, struct inode *dir, } EXPORT_SYMBOL(vfs_symlink); -int do_symlinkat(struct filename *from, int newdfd, struct filename *to) +int filename_symlinkat(struct filename *from, int newdfd, struct filename *to) { int error; struct dentry *dentry; @@ -5589,15 +5589,13 @@ int do_symlinkat(struct filename *from, int newdfd, struct filename *to) unsigned int lookup_flags = 0; struct delegated_inode delegated_inode = { }; - if (IS_ERR(from)) { - error = PTR_ERR(from); - goto out_putnames; - } + if (IS_ERR(from)) + return PTR_ERR(from); + retry: dentry = filename_create(newdfd, to, &path, lookup_flags); - error = PTR_ERR(dentry); if (IS_ERR(dentry)) - goto out_putnames; + return PTR_ERR(dentry); error = security_path_symlink(&path, dentry, from->name); if (!error) @@ -5613,21 +5611,22 @@ retry: lookup_flags |= LOOKUP_REVAL; goto retry; } -out_putnames: - putname(to); - putname(from); return error; } SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, int, newdfd, const char __user *, newname) { - return do_symlinkat(getname(oldname), newdfd, getname(newname)); + CLASS(filename, old)(oldname); + CLASS(filename, new)(newname); + return filename_symlinkat(old, newdfd, new); } SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname) { - return do_symlinkat(getname(oldname), AT_FDCWD, getname(newname)); + CLASS(filename, old)(oldname); + CLASS(filename, new)(newname); + return filename_symlinkat(old, AT_FDCWD, new); } /** diff --git a/io_uring/fs.c b/io_uring/fs.c index e39cd1ca1942..cd4d88d37795 100644 --- a/io_uring/fs.c +++ b/io_uring/fs.c @@ -233,12 +233,13 @@ int io_symlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) int io_symlinkat(struct io_kiocb *req, unsigned int issue_flags) { struct io_link *sl = io_kiocb_to_cmd(req, struct io_link); + CLASS(filename_complete_delayed, old)(&sl->oldpath); + CLASS(filename_complete_delayed, new)(&sl->newpath); int ret; WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); - ret = do_symlinkat(complete_getname(&sl->oldpath), sl->new_dfd, - complete_getname(&sl->newpath)); + ret = filename_symlinkat(old, sl->new_dfd, new); req->flags &= ~REQ_F_NEED_CLEANUP; io_req_set_res(req, ret, 0); From dc912db15ab19d366c56d34a4f06fe49334450b8 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 6 Jan 2026 23:28:57 -0500 Subject: [PATCH 42/68] non-consuming variant of do_mkdirat() similar to previous commit; replacement is filename_mkdirat() Signed-off-by: Al Viro --- Documentation/filesystems/porting.rst | 2 +- fs/init.c | 3 ++- fs/internal.h | 2 +- fs/namei.c | 13 ++++++------- io_uring/fs.c | 3 ++- 5 files changed, 12 insertions(+), 11 deletions(-) diff --git a/Documentation/filesystems/porting.rst b/Documentation/filesystems/porting.rst index bb526ae9a1d7..d75b549ed528 100644 --- a/Documentation/filesystems/porting.rst +++ b/Documentation/filesystems/porting.rst @@ -1343,4 +1343,4 @@ fs/namei.c primitives that consume filesystem references (do_renameat2(), do_linkat(), do_symlinkat(), do_mkdirat(), do_mknodat(), do_unlinkat() and do_rmdir()) are getting replaced with non-consuming analogues (filename_renameat2(), etc.) Replaced so far: do_renameat2(), do_linkat(), -do_symlinkat(). +do_symlinkat(), do_mkdirat(). diff --git a/fs/init.c b/fs/init.c index a54ef750ffe3..9a550ba4802f 100644 --- a/fs/init.c +++ b/fs/init.c @@ -164,7 +164,8 @@ int __init init_unlink(const char *pathname) int __init init_mkdir(const char *pathname, umode_t mode) { - return do_mkdirat(AT_FDCWD, getname_kernel(pathname), mode); + CLASS(filename_kernel, name)(pathname); + return filename_mkdirat(AT_FDCWD, name, mode); } int __init init_rmdir(const char *pathname) diff --git a/fs/internal.h b/fs/internal.h index 4a63b89c02d7..03638008d84a 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -59,7 +59,7 @@ int do_unlinkat(int dfd, struct filename *name); int may_linkat(struct mnt_idmap *idmap, const struct path *link); int filename_renameat2(int olddfd, struct filename *oldname, int newdfd, struct filename *newname, unsigned int flags); -int do_mkdirat(int dfd, struct filename *name, umode_t mode); +int filename_mkdirat(int dfd, struct filename *name, umode_t mode); int do_mknodat(int dfd, struct filename *name, umode_t mode, unsigned int dev); int filename_symlinkat(struct filename *from, int newdfd, struct filename *to); int filename_linkat(int olddfd, struct filename *old, int newdfd, diff --git a/fs/namei.c b/fs/namei.c index c88ad27f66c7..21a2dbd8b9e6 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -5207,7 +5207,7 @@ err: } EXPORT_SYMBOL(vfs_mkdir); -int do_mkdirat(int dfd, struct filename *name, umode_t mode) +int filename_mkdirat(int dfd, struct filename *name, umode_t mode) { struct dentry *dentry; struct path path; @@ -5217,9 +5217,8 @@ int do_mkdirat(int dfd, struct filename *name, umode_t mode) retry: dentry = filename_create(dfd, name, &path, lookup_flags); - error = PTR_ERR(dentry); if (IS_ERR(dentry)) - goto out_putname; + return PTR_ERR(dentry); error = security_path_mkdir(&path, dentry, mode_strip_umask(path.dentry->d_inode, mode)); @@ -5239,19 +5238,19 @@ retry: lookup_flags |= LOOKUP_REVAL; goto retry; } -out_putname: - putname(name); return error; } SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) { - return do_mkdirat(dfd, getname(pathname), mode); + CLASS(filename, name)(pathname); + return filename_mkdirat(dfd, name, mode); } SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode) { - return do_mkdirat(AT_FDCWD, getname(pathname), mode); + CLASS(filename, name)(pathname); + return filename_mkdirat(AT_FDCWD, name, mode); } /** diff --git a/io_uring/fs.c b/io_uring/fs.c index cd4d88d37795..40541b539e0d 100644 --- a/io_uring/fs.c +++ b/io_uring/fs.c @@ -182,11 +182,12 @@ int io_mkdirat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) int io_mkdirat(struct io_kiocb *req, unsigned int issue_flags) { struct io_mkdir *mkd = io_kiocb_to_cmd(req, struct io_mkdir); + CLASS(filename_complete_delayed, name)(&mkd->filename); int ret; WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); - ret = do_mkdirat(mkd->dfd, complete_getname(&mkd->filename), mkd->mode); + ret = filename_mkdirat(mkd->dfd, name, mkd->mode); req->flags &= ~REQ_F_NEED_CLEANUP; io_req_set_res(req, ret, 0); From 88fdc2761797ee7a537f92a84a4d4ac2e04436a4 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 6 Jan 2026 23:30:02 -0500 Subject: [PATCH 43/68] non-consuming variant of do_mknodat() similar to previous commit; replacement is filename_mknodat() Signed-off-by: Al Viro --- Documentation/filesystems/porting.rst | 2 +- fs/init.c | 3 ++- fs/internal.h | 2 +- fs/namei.c | 17 ++++++++--------- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/Documentation/filesystems/porting.rst b/Documentation/filesystems/porting.rst index d75b549ed528..d9a94a071852 100644 --- a/Documentation/filesystems/porting.rst +++ b/Documentation/filesystems/porting.rst @@ -1343,4 +1343,4 @@ fs/namei.c primitives that consume filesystem references (do_renameat2(), do_linkat(), do_symlinkat(), do_mkdirat(), do_mknodat(), do_unlinkat() and do_rmdir()) are getting replaced with non-consuming analogues (filename_renameat2(), etc.) Replaced so far: do_renameat2(), do_linkat(), -do_symlinkat(), do_mkdirat(). +do_symlinkat(), do_mkdirat(), do_mknodat(). diff --git a/fs/init.c b/fs/init.c index 9a550ba4802f..543444c1d79e 100644 --- a/fs/init.c +++ b/fs/init.c @@ -140,7 +140,8 @@ int __init init_stat(const char *filename, struct kstat *stat, int flags) int __init init_mknod(const char *filename, umode_t mode, unsigned int dev) { - return do_mknodat(AT_FDCWD, getname_kernel(filename), mode, dev); + CLASS(filename_kernel, name)(filename); + return filename_mknodat(AT_FDCWD, name, mode, dev); } int __init init_link(const char *oldname, const char *newname) diff --git a/fs/internal.h b/fs/internal.h index 03638008d84a..02b5dec13ff3 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -60,7 +60,7 @@ int may_linkat(struct mnt_idmap *idmap, const struct path *link); int filename_renameat2(int olddfd, struct filename *oldname, int newdfd, struct filename *newname, unsigned int flags); int filename_mkdirat(int dfd, struct filename *name, umode_t mode); -int do_mknodat(int dfd, struct filename *name, umode_t mode, unsigned int dev); +int filename_mknodat(int dfd, struct filename *name, umode_t mode, unsigned int dev); int filename_symlinkat(struct filename *from, int newdfd, struct filename *to); int filename_linkat(int olddfd, struct filename *old, int newdfd, struct filename *new, int flags); diff --git a/fs/namei.c b/fs/namei.c index 21a2dbd8b9e6..ca524c5b18f4 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -5072,8 +5072,8 @@ static int may_mknod(umode_t mode) } } -int do_mknodat(int dfd, struct filename *name, umode_t mode, - unsigned int dev) +int filename_mknodat(int dfd, struct filename *name, umode_t mode, + unsigned int dev) { struct delegated_inode di = { }; struct mnt_idmap *idmap; @@ -5084,12 +5084,11 @@ int do_mknodat(int dfd, struct filename *name, umode_t mode, error = may_mknod(mode); if (error) - goto out1; + return error; retry: dentry = filename_create(dfd, name, &path, lookup_flags); - error = PTR_ERR(dentry); if (IS_ERR(dentry)) - goto out1; + return PTR_ERR(dentry); error = security_path_mknod(&path, dentry, mode_strip_umask(path.dentry->d_inode, mode), dev); @@ -5123,20 +5122,20 @@ out2: lookup_flags |= LOOKUP_REVAL; goto retry; } -out1: - putname(name); return error; } SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, unsigned int, dev) { - return do_mknodat(dfd, getname(filename), mode, dev); + CLASS(filename, name)(filename); + return filename_mknodat(dfd, name, mode, dev); } SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev) { - return do_mknodat(AT_FDCWD, getname(filename), mode, dev); + CLASS(filename, name)(filename); + return filename_mknodat(AT_FDCWD, name, mode, dev); } /** From e50aae1d39ac37a95f453a699456b73dd07e3913 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 6 Jan 2026 23:33:31 -0500 Subject: [PATCH 44/68] non-consuming variants of do_{unlinkat,rmdir}() similar to previous commit; replacements are filename_{unlinkat,rmdir}() Signed-off-by: Al Viro --- Documentation/filesystems/porting.rst | 7 ++++--- fs/coredump.c | 3 ++- fs/init.c | 6 ++++-- fs/internal.h | 4 ++-- fs/namei.c | 23 +++++++++++------------ io_uring/fs.c | 5 +++-- 6 files changed, 26 insertions(+), 22 deletions(-) diff --git a/Documentation/filesystems/porting.rst b/Documentation/filesystems/porting.rst index d9a94a071852..909c7d0232f9 100644 --- a/Documentation/filesystems/porting.rst +++ b/Documentation/filesystems/porting.rst @@ -1341,6 +1341,7 @@ in-tree filesystems have done). fs/namei.c primitives that consume filesystem references (do_renameat2(), do_linkat(), do_symlinkat(), do_mkdirat(), do_mknodat(), do_unlinkat() -and do_rmdir()) are getting replaced with non-consuming analogues -(filename_renameat2(), etc.) Replaced so far: do_renameat2(), do_linkat(), -do_symlinkat(), do_mkdirat(), do_mknodat(). +and do_rmdir()) are gone; they are replaced with non-consuming analogues +(filename_renameat2(), etc.) +Callers are adjusted - responsibility for dropping the filenames belongs +to them now. diff --git a/fs/coredump.c b/fs/coredump.c index 8feb9c1cf83d..d9597610a6ca 100644 --- a/fs/coredump.c +++ b/fs/coredump.c @@ -895,11 +895,12 @@ static bool coredump_file(struct core_name *cn, struct coredump_params *cprm, * privs and don't want to unlink another user's coredump. */ if (!coredump_force_suid_safe(cprm)) { + CLASS(filename_kernel, name)(cn->corename); /* * If it doesn't exist, that's fine. If there's some * other problem, we'll catch it at the filp_open(). */ - do_unlinkat(AT_FDCWD, getname_kernel(cn->corename)); + filename_unlinkat(AT_FDCWD, name); } /* diff --git a/fs/init.c b/fs/init.c index 543444c1d79e..ea528b020cd1 100644 --- a/fs/init.c +++ b/fs/init.c @@ -160,7 +160,8 @@ int __init init_symlink(const char *oldname, const char *newname) int __init init_unlink(const char *pathname) { - return do_unlinkat(AT_FDCWD, getname_kernel(pathname)); + CLASS(filename_kernel, name)(pathname); + return filename_unlinkat(AT_FDCWD, name); } int __init init_mkdir(const char *pathname, umode_t mode) @@ -171,7 +172,8 @@ int __init init_mkdir(const char *pathname, umode_t mode) int __init init_rmdir(const char *pathname) { - return do_rmdir(AT_FDCWD, getname_kernel(pathname)); + CLASS(filename_kernel, name)(pathname); + return filename_rmdir(AT_FDCWD, name); } int __init init_utimes(char *filename, struct timespec64 *ts) diff --git a/fs/internal.h b/fs/internal.h index 02b5dec13ff3..4821f8b8fdda 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -54,8 +54,8 @@ extern int finish_clean_context(struct fs_context *fc); */ extern int filename_lookup(int dfd, struct filename *name, unsigned flags, struct path *path, const struct path *root); -int do_rmdir(int dfd, struct filename *name); -int do_unlinkat(int dfd, struct filename *name); +int filename_rmdir(int dfd, struct filename *name); +int filename_unlinkat(int dfd, struct filename *name); int may_linkat(struct mnt_idmap *idmap, const struct path *link); int filename_renameat2(int olddfd, struct filename *oldname, int newdfd, struct filename *newname, unsigned int flags); diff --git a/fs/namei.c b/fs/namei.c index ca524c5b18f4..ba6e15339ad6 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -5312,7 +5312,7 @@ out: } EXPORT_SYMBOL(vfs_rmdir); -int do_rmdir(int dfd, struct filename *name) +int filename_rmdir(int dfd, struct filename *name) { int error; struct dentry *dentry; @@ -5324,7 +5324,7 @@ int do_rmdir(int dfd, struct filename *name) retry: error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type); if (error) - goto exit1; + return error; switch (type) { case LAST_DOTDOT: @@ -5366,14 +5366,13 @@ exit2: lookup_flags |= LOOKUP_REVAL; goto retry; } -exit1: - putname(name); return error; } SYSCALL_DEFINE1(rmdir, const char __user *, pathname) { - return do_rmdir(AT_FDCWD, getname(pathname)); + CLASS(filename, name)(pathname); + return filename_rmdir(AT_FDCWD, name); } /** @@ -5455,7 +5454,7 @@ EXPORT_SYMBOL(vfs_unlink); * writeout happening, and we don't want to prevent access to the directory * while waiting on the I/O. */ -int do_unlinkat(int dfd, struct filename *name) +int filename_unlinkat(int dfd, struct filename *name) { int error; struct dentry *dentry; @@ -5468,7 +5467,7 @@ int do_unlinkat(int dfd, struct filename *name) retry: error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type); if (error) - goto exit_putname; + return error; error = -EISDIR; if (type != LAST_NORM) @@ -5515,8 +5514,6 @@ exit_path_put: lookup_flags |= LOOKUP_REVAL; goto retry; } -exit_putname: - putname(name); return error; } @@ -5525,14 +5522,16 @@ SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) if ((flag & ~AT_REMOVEDIR) != 0) return -EINVAL; + CLASS(filename, name)(pathname); if (flag & AT_REMOVEDIR) - return do_rmdir(dfd, getname(pathname)); - return do_unlinkat(dfd, getname(pathname)); + return filename_rmdir(dfd, name); + return filename_unlinkat(dfd, name); } SYSCALL_DEFINE1(unlink, const char __user *, pathname) { - return do_unlinkat(AT_FDCWD, getname(pathname)); + CLASS(filename, name)(pathname); + return filename_unlinkat(AT_FDCWD, name); } /** diff --git a/io_uring/fs.c b/io_uring/fs.c index 40541b539e0d..d0580c754bf8 100644 --- a/io_uring/fs.c +++ b/io_uring/fs.c @@ -134,14 +134,15 @@ int io_unlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) int io_unlinkat(struct io_kiocb *req, unsigned int issue_flags) { struct io_unlink *un = io_kiocb_to_cmd(req, struct io_unlink); + CLASS(filename_complete_delayed, name)(&un->filename); int ret; WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); if (un->flags & AT_REMOVEDIR) - ret = do_rmdir(un->dfd, complete_getname(&un->filename)); + ret = filename_rmdir(un->dfd, name); else - ret = do_unlinkat(un->dfd, complete_getname(&un->filename)); + ret = filename_unlinkat(un->dfd, name); req->flags &= ~REQ_F_NEED_CLEANUP; io_req_set_res(req, ret, 0); From 5b9d406ff7cfde3f0367cac209d5bb2ac1c6e6b3 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 6 Dec 2025 14:33:29 -0500 Subject: [PATCH 45/68] filename_...xattr(): don't consume filename reference Callers switched to CLASS(filename_maybe_null) (in fs/xattr.c) and CLASS(filename_complete_delayed) (in io_uring/xattr.c). Signed-off-by: Al Viro --- fs/xattr.c | 33 ++++++++------------------------- io_uring/xattr.c | 8 ++++---- 2 files changed, 12 insertions(+), 29 deletions(-) diff --git a/fs/xattr.c b/fs/xattr.c index 32d445fb60aa..3e49e612e1ba 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -649,7 +649,6 @@ int file_setxattr(struct file *f, struct kernel_xattr_ctx *ctx) return error; } -/* unconditionally consumes filename */ int filename_setxattr(int dfd, struct filename *filename, unsigned int lookup_flags, struct kernel_xattr_ctx *ctx) { @@ -659,7 +658,7 @@ int filename_setxattr(int dfd, struct filename *filename, retry: error = filename_lookup(dfd, filename, lookup_flags, &path, NULL); if (error) - goto out; + return error; error = mnt_want_write(path.mnt); if (!error) { error = do_setxattr(mnt_idmap(path.mnt), path.dentry, ctx); @@ -670,9 +669,6 @@ retry: lookup_flags |= LOOKUP_REVAL; goto retry; } - -out: - putname(filename); return error; } @@ -688,7 +684,6 @@ static int path_setxattrat(int dfd, const char __user *pathname, .kname = &kname, .flags = flags, }; - struct filename *filename; unsigned int lookup_flags = 0; int error; @@ -702,7 +697,7 @@ static int path_setxattrat(int dfd, const char __user *pathname, if (error) return error; - filename = getname_maybe_null(pathname, at_flags); + CLASS(filename_maybe_null, filename)(pathname, at_flags); if (!filename && dfd >= 0) { CLASS(fd, f)(dfd); if (fd_empty(f)) @@ -804,7 +799,6 @@ ssize_t file_getxattr(struct file *f, struct kernel_xattr_ctx *ctx) return do_getxattr(file_mnt_idmap(f), f->f_path.dentry, ctx); } -/* unconditionally consumes filename */ ssize_t filename_getxattr(int dfd, struct filename *filename, unsigned int lookup_flags, struct kernel_xattr_ctx *ctx) { @@ -813,15 +807,13 @@ ssize_t filename_getxattr(int dfd, struct filename *filename, retry: error = filename_lookup(dfd, filename, lookup_flags, &path, NULL); if (error) - goto out; + return error; error = do_getxattr(mnt_idmap(path.mnt), path.dentry, ctx); path_put(&path); if (retry_estale(error, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; goto retry; } -out: - putname(filename); return error; } @@ -836,7 +828,6 @@ static ssize_t path_getxattrat(int dfd, const char __user *pathname, .kname = &kname, .flags = 0, }; - struct filename *filename; ssize_t error; if ((at_flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0) @@ -846,7 +837,7 @@ static ssize_t path_getxattrat(int dfd, const char __user *pathname, if (error) return error; - filename = getname_maybe_null(pathname, at_flags); + CLASS(filename_maybe_null, filename)(pathname, at_flags); if (!filename && dfd >= 0) { CLASS(fd, f)(dfd); if (fd_empty(f)) @@ -943,7 +934,6 @@ ssize_t file_listxattr(struct file *f, char __user *list, size_t size) return listxattr(f->f_path.dentry, list, size); } -/* unconditionally consumes filename */ static ssize_t filename_listxattr(int dfd, struct filename *filename, unsigned int lookup_flags, @@ -954,15 +944,13 @@ ssize_t filename_listxattr(int dfd, struct filename *filename, retry: error = filename_lookup(dfd, filename, lookup_flags, &path, NULL); if (error) - goto out; + return error; error = listxattr(path.dentry, list, size); path_put(&path); if (retry_estale(error, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; goto retry; } -out: - putname(filename); return error; } @@ -970,13 +958,12 @@ static ssize_t path_listxattrat(int dfd, const char __user *pathname, unsigned int at_flags, char __user *list, size_t size) { - struct filename *filename; int lookup_flags; if ((at_flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0) return -EINVAL; - filename = getname_maybe_null(pathname, at_flags); + CLASS(filename_maybe_null, filename)(pathname, at_flags); if (!filename) { CLASS(fd, f)(dfd); if (fd_empty(f)) @@ -1036,7 +1023,6 @@ static int file_removexattr(struct file *f, struct xattr_name *kname) return error; } -/* unconditionally consumes filename */ static int filename_removexattr(int dfd, struct filename *filename, unsigned int lookup_flags, struct xattr_name *kname) { @@ -1046,7 +1032,7 @@ static int filename_removexattr(int dfd, struct filename *filename, retry: error = filename_lookup(dfd, filename, lookup_flags, &path, NULL); if (error) - goto out; + return error; error = mnt_want_write(path.mnt); if (!error) { error = removexattr(mnt_idmap(path.mnt), path.dentry, kname->name); @@ -1057,8 +1043,6 @@ retry: lookup_flags |= LOOKUP_REVAL; goto retry; } -out: - putname(filename); return error; } @@ -1066,7 +1050,6 @@ static int path_removexattrat(int dfd, const char __user *pathname, unsigned int at_flags, const char __user *name) { struct xattr_name kname; - struct filename *filename; unsigned int lookup_flags; int error; @@ -1077,7 +1060,7 @@ static int path_removexattrat(int dfd, const char __user *pathname, if (error) return error; - filename = getname_maybe_null(pathname, at_flags); + CLASS(filename_maybe_null, filename)(pathname, at_flags); if (!filename) { CLASS(fd, f)(dfd); if (fd_empty(f)) diff --git a/io_uring/xattr.c b/io_uring/xattr.c index 0fb4e5303500..ba2b98cf13f9 100644 --- a/io_uring/xattr.c +++ b/io_uring/xattr.c @@ -109,12 +109,12 @@ int io_fgetxattr(struct io_kiocb *req, unsigned int issue_flags) int io_getxattr(struct io_kiocb *req, unsigned int issue_flags) { struct io_xattr *ix = io_kiocb_to_cmd(req, struct io_xattr); + CLASS(filename_complete_delayed, name)(&ix->filename); int ret; WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); - ret = filename_getxattr(AT_FDCWD, complete_getname(&ix->filename), - LOOKUP_FOLLOW, &ix->ctx); + ret = filename_getxattr(AT_FDCWD, name, LOOKUP_FOLLOW, &ix->ctx); io_xattr_finish(req, ret); return IOU_COMPLETE; } @@ -186,12 +186,12 @@ int io_fsetxattr(struct io_kiocb *req, unsigned int issue_flags) int io_setxattr(struct io_kiocb *req, unsigned int issue_flags) { struct io_xattr *ix = io_kiocb_to_cmd(req, struct io_xattr); + CLASS(filename_complete_delayed, name)(&ix->filename); int ret; WARN_ON_ONCE(issue_flags & IO_URING_F_NONBLOCK); - ret = filename_setxattr(AT_FDCWD, complete_getname(&ix->filename), - LOOKUP_FOLLOW, &ix->ctx); + ret = filename_setxattr(AT_FDCWD, name, LOOKUP_FOLLOW, &ix->ctx); io_xattr_finish(req, ret); return IOU_COMPLETE; } From 70772cafff8b8f02a33a56660f84d8b4011ddeb5 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 4 Dec 2025 14:43:24 -0500 Subject: [PATCH 46/68] file_[gs]etattr(2): switch to CLASS(filename_maybe_null) Signed-off-by: Al Viro --- fs/file_attr.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/file_attr.c b/fs/file_attr.c index f44ce46e1411..42721427245a 100644 --- a/fs/file_attr.c +++ b/fs/file_attr.c @@ -374,7 +374,6 @@ SYSCALL_DEFINE5(file_getattr, int, dfd, const char __user *, filename, unsigned int, at_flags) { struct path filepath __free(path_put) = {}; - struct filename *name __free(putname) = NULL; unsigned int lookup_flags = 0; struct file_attr fattr; struct file_kattr fa; @@ -395,7 +394,7 @@ SYSCALL_DEFINE5(file_getattr, int, dfd, const char __user *, filename, if (usize < FILE_ATTR_SIZE_VER0) return -EINVAL; - name = getname_maybe_null(filename, at_flags); + CLASS(filename_maybe_null, name)(filename, at_flags); if (!name && dfd >= 0) { CLASS(fd, f)(dfd); if (fd_empty(f)) @@ -428,7 +427,6 @@ SYSCALL_DEFINE5(file_setattr, int, dfd, const char __user *, filename, unsigned int, at_flags) { struct path filepath __free(path_put) = {}; - struct filename *name __free(putname) = NULL; unsigned int lookup_flags = 0; struct file_attr fattr; struct file_kattr fa; @@ -458,7 +456,7 @@ SYSCALL_DEFINE5(file_setattr, int, dfd, const char __user *, filename, if (error) return error; - name = getname_maybe_null(filename, at_flags); + CLASS(filename_maybe_null, name)(filename, at_flags); if (!name && dfd >= 0) { CLASS(fd, f)(dfd); if (fd_empty(f)) From 57cd2072bda9d15df427f3d38b9cab4aad3cb55f Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 20 Sep 2024 14:08:37 -0400 Subject: [PATCH 47/68] mount_setattr(2): don't mess with LOOKUP_EMPTY just use CLASS(filename_uflags) + filename_lookup() Signed-off-by: Al Viro --- fs/namespace.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index 9d0d8ed16264..d632180f9b1a 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -4978,8 +4978,6 @@ SYSCALL_DEFINE5(mount_setattr, int, dfd, const char __user *, path, lookup_flags &= ~LOOKUP_AUTOMOUNT; if (flags & AT_SYMLINK_NOFOLLOW) lookup_flags &= ~LOOKUP_FOLLOW; - if (flags & AT_EMPTY_PATH) - lookup_flags |= LOOKUP_EMPTY; kattr = (struct mount_kattr) { .lookup_flags = lookup_flags, @@ -4992,7 +4990,8 @@ SYSCALL_DEFINE5(mount_setattr, int, dfd, const char __user *, path, if (err <= 0) return err; - err = user_path_at(dfd, path, kattr.lookup_flags, &target); + CLASS(filename_uflags, name)(path, flags); + err = filename_lookup(dfd, name, kattr.lookup_flags, &target, NULL); if (!err) { err = do_mount_setattr(&target, &kattr); path_put(&target); From 819cb2c1dd8dc1168d5f1810182f1cf1925b4d2f Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 20 Sep 2024 00:48:51 -0400 Subject: [PATCH 48/68] do_open_execat(): don't care about LOOKUP_EMPTY do_file_open() doesn't. Signed-off-by: Al Viro --- fs/exec.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 5dd8ff61f27a..a4f29d2c2d3a 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -777,8 +777,6 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags) return ERR_PTR(-EINVAL); if (flags & AT_SYMLINK_NOFOLLOW) open_exec_flags.lookup_flags &= ~LOOKUP_FOLLOW; - if (flags & AT_EMPTY_PATH) - open_exec_flags.lookup_flags |= LOOKUP_EMPTY; file = do_file_open(fd, name, &open_exec_flags); if (IS_ERR(file)) From b79b3c1f66131bd1ee705e9e42afe377373563be Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2025 17:48:06 -0400 Subject: [PATCH 49/68] vfs_open_tree(): use CLASS(filename_uflags) Signed-off-by: Al Viro --- fs/namespace.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index d632180f9b1a..888df8ee43bc 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -3082,13 +3082,12 @@ static struct file *vfs_open_tree(int dfd, const char __user *filename, unsigned lookup_flags &= ~LOOKUP_AUTOMOUNT; if (flags & AT_SYMLINK_NOFOLLOW) lookup_flags &= ~LOOKUP_FOLLOW; - if (flags & AT_EMPTY_PATH) - lookup_flags |= LOOKUP_EMPTY; if (detached && !may_mount()) return ERR_PTR(-EPERM); - ret = user_path_at(dfd, filename, lookup_flags, &path); + CLASS(filename_uflags, name)(filename, flags); + ret = filename_lookup(dfd, name, lookup_flags, &path, NULL); if (unlikely(ret)) return ERR_PTR(ret); From 154ef7dce6a4d6afd1cf94de2098eb6f60821345 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 20 Sep 2024 14:12:14 -0400 Subject: [PATCH 50/68] name_to_handle_at(): use CLASS(filename_uflags) Signed-off-by: Al Viro --- fs/fhandle.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fs/fhandle.c b/fs/fhandle.c index 3de1547ec9d4..e15bcf4b0b23 100644 --- a/fs/fhandle.c +++ b/fs/fhandle.c @@ -157,9 +157,8 @@ SYSCALL_DEFINE5(name_to_handle_at, int, dfd, const char __user *, name, fh_flags |= EXPORT_FH_CONNECTABLE; lookup_flags = (flag & AT_SYMLINK_FOLLOW) ? LOOKUP_FOLLOW : 0; - if (flag & AT_EMPTY_PATH) - lookup_flags |= LOOKUP_EMPTY; - err = user_path_at(dfd, name, lookup_flags, &path); + CLASS(filename_uflags, filename)(name, flag); + err = filename_lookup(dfd, filename, lookup_flags, &path, NULL); if (!err) { err = do_sys_name_to_handle(&path, handle, mnt_id, flag & AT_HANDLE_MNT_ID_UNIQUE, From 7f583ad97c6a87e8ea7b7b875dabe2f84fedfd5e Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2025 17:53:48 -0400 Subject: [PATCH 51/68] fspick(2): use CLASS(filename_flags) That kills the last place where we mix LOOKUP_EMPTY with lookup flags proper. Signed-off-by: Al Viro --- fs/fsopen.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/fsopen.c b/fs/fsopen.c index f645c99204eb..70f4ab183c9e 100644 --- a/fs/fsopen.c +++ b/fs/fsopen.c @@ -181,9 +181,9 @@ SYSCALL_DEFINE3(fspick, int, dfd, const char __user *, path, unsigned int, flags lookup_flags &= ~LOOKUP_FOLLOW; if (flags & FSPICK_NO_AUTOMOUNT) lookup_flags &= ~LOOKUP_AUTOMOUNT; - if (flags & FSPICK_EMPTY_PATH) - lookup_flags |= LOOKUP_EMPTY; - ret = user_path_at(dfd, path, lookup_flags, &target); + CLASS(filename_flags, filename)(path, + (flags & FSPICK_EMPTY_PATH) ? LOOKUP_EMPTY : 0); + ret = filename_lookup(dfd, filename, lookup_flags, &target, NULL); if (ret < 0) goto err; From f770e4c1a488edb5ea96cce67f41607c259d704c Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 31 Oct 2025 13:50:33 -0400 Subject: [PATCH 52/68] do_fchownat(): unspaghettify a bit... Signed-off-by: Al Viro --- fs/open.c | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-) diff --git a/fs/open.c b/fs/open.c index 7254eda9f4a5..425c09d83d7f 100644 --- a/fs/open.c +++ b/fs/open.c @@ -810,30 +810,26 @@ int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group, struct path path; int error; int lookup_flags; - struct filename *name; if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0) return -EINVAL; lookup_flags = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW; - name = getname_uflags(filename, flag); + CLASS(filename_uflags, name)(filename, flag); retry: error = filename_lookup(dfd, name, lookup_flags, &path, NULL); - if (error) - goto out; - error = mnt_want_write(path.mnt); - if (error) - goto out_release; - error = chown_common(&path, user, group); - mnt_drop_write(path.mnt); -out_release: - path_put(&path); - if (retry_estale(error, lookup_flags)) { - lookup_flags |= LOOKUP_REVAL; - goto retry; + if (!error) { + error = mnt_want_write(path.mnt); + if (!error) { + error = chown_common(&path, user, group); + mnt_drop_write(path.mnt); + } + path_put(&path); + if (retry_estale(error, lookup_flags)) { + lookup_flags |= LOOKUP_REVAL; + goto retry; + } } -out: - putname(name); return error; } From 4e9654c2bb468ce15df2ec3db27d35b3d7f85ca3 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 31 Oct 2025 13:56:45 -0400 Subject: [PATCH 53/68] chdir(2): unspaghettify a bit... Signed-off-by: Al Viro --- fs/open.c | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-) diff --git a/fs/open.c b/fs/open.c index 425c09d83d7f..bcaaf884e436 100644 --- a/fs/open.c +++ b/fs/open.c @@ -558,26 +558,19 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename) struct path path; int error; unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY; - struct filename *name = getname(filename); + CLASS(filename, name)(filename); retry: error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); - if (error) - goto out; - - error = path_permission(&path, MAY_EXEC | MAY_CHDIR); - if (error) - goto dput_and_out; - - set_fs_pwd(current->fs, &path); - -dput_and_out: - path_put(&path); - if (retry_estale(error, lookup_flags)) { - lookup_flags |= LOOKUP_REVAL; - goto retry; + if (!error) { + error = path_permission(&path, MAY_EXEC | MAY_CHDIR); + if (!error) + set_fs_pwd(current->fs, &path); + path_put(&path); + if (retry_estale(error, lookup_flags)) { + lookup_flags |= LOOKUP_REVAL; + goto retry; + } } -out: - putname(name); return error; } From 7273ed4e780c64fae127b8c1de4b5000f9e0bac1 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 4 Dec 2025 18:07:19 -0500 Subject: [PATCH 54/68] do_utimes_path(): switch to CLASS(filename_uflags) Signed-off-by: Al Viro --- fs/utimes.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/fs/utimes.c b/fs/utimes.c index 84889ea1780e..e22664e4115f 100644 --- a/fs/utimes.c +++ b/fs/utimes.c @@ -84,27 +84,24 @@ static int do_utimes_path(int dfd, const char __user *filename, { struct path path; int lookup_flags = 0, error; - struct filename *name; if (flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) return -EINVAL; if (!(flags & AT_SYMLINK_NOFOLLOW)) lookup_flags |= LOOKUP_FOLLOW; - name = getname_uflags(filename, flags); + CLASS(filename_uflags, name)(filename, flags); retry: error = filename_lookup(dfd, name, lookup_flags, &path, NULL); if (error) - goto out; + return error; error = vfs_utimes(&path, times); path_put(&path); if (retry_estale(error, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; goto retry; } -out: - putname(name); return error; } From 97ed55d2f503d42aefc9695cf69954c10366588c Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 11 Oct 2024 00:07:03 -0400 Subject: [PATCH 55/68] do_sys_truncate(): switch to CLASS(filename) Note that failures from filename_lookup() are final - ESTALE returned by it means that retry had been done by filename_lookup() and it failed there. Signed-off-by: Al Viro --- fs/open.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/fs/open.c b/fs/open.c index bcaaf884e436..34d9b1ecc141 100644 --- a/fs/open.c +++ b/fs/open.c @@ -129,25 +129,23 @@ EXPORT_SYMBOL_GPL(vfs_truncate); int do_sys_truncate(const char __user *pathname, loff_t length) { unsigned int lookup_flags = LOOKUP_FOLLOW; - struct filename *name; struct path path; int error; if (length < 0) /* sorry, but loff_t says... */ return -EINVAL; - name = getname(pathname); + CLASS(filename, name)(pathname); retry: error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); if (!error) { error = vfs_truncate(&path, length); path_put(&path); + if (retry_estale(error, lookup_flags)) { + lookup_flags |= LOOKUP_REVAL; + goto retry; + } } - if (retry_estale(error, lookup_flags)) { - lookup_flags |= LOOKUP_REVAL; - goto retry; - } - putname(name); return error; } From d4ffeabea744a772cbce40c41f94accf9841d6e5 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 20 Sep 2024 12:35:42 -0400 Subject: [PATCH 56/68] do_readlinkat(): switch to CLASS(filename_flags) Signed-off-by: Al Viro --- fs/stat.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/fs/stat.c b/fs/stat.c index ee9ae2c3273a..d18577f3688c 100644 --- a/fs/stat.c +++ b/fs/stat.c @@ -564,20 +564,17 @@ static int do_readlinkat(int dfd, const char __user *pathname, char __user *buf, int bufsiz) { struct path path; - struct filename *name; int error; unsigned int lookup_flags = 0; if (bufsiz <= 0) return -EINVAL; - name = getname_flags(pathname, LOOKUP_EMPTY); + CLASS(filename_flags, name)(pathname, LOOKUP_EMPTY); retry: error = filename_lookup(dfd, name, lookup_flags, &path, NULL); - if (unlikely(error)) { - putname(name); + if (unlikely(error)) return error; - } /* * AFS mountpoints allow readlink(2) but are not symlinks @@ -597,7 +594,6 @@ retry: lookup_flags |= LOOKUP_REVAL; goto retry; } - putname(name); return error; } From 33b54bc7998940c1dd4770c5ed0e182504302032 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 10 Oct 2024 20:45:08 -0400 Subject: [PATCH 57/68] do_f{chmod,chown,access}at(): use CLASS(filename_uflags) Signed-off-by: Al Viro --- fs/open.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/fs/open.c b/fs/open.c index 34d9b1ecc141..3c7081694326 100644 --- a/fs/open.c +++ b/fs/open.c @@ -469,7 +469,6 @@ static int do_faccessat(int dfd, const char __user *filename, int mode, int flag int res; unsigned int lookup_flags = LOOKUP_FOLLOW; const struct cred *old_cred = NULL; - struct filename *name; if (mode & ~S_IRWXO) /* where's F_OK, X_OK, W_OK, R_OK? */ return -EINVAL; @@ -486,7 +485,7 @@ static int do_faccessat(int dfd, const char __user *filename, int mode, int flag return -ENOMEM; } - name = getname_uflags(filename, flags); + CLASS(filename_uflags, name)(filename, flags); retry: res = filename_lookup(dfd, name, lookup_flags, &path, NULL); if (res) @@ -528,7 +527,6 @@ out_path_release: goto retry; } out: - putname(name); if (old_cred) put_cred(revert_creds(old_cred)); @@ -677,7 +675,6 @@ static int do_fchmodat(int dfd, const char __user *filename, umode_t mode, unsigned int flags) { struct path path; - struct filename *name; int error; unsigned int lookup_flags; @@ -685,7 +682,7 @@ static int do_fchmodat(int dfd, const char __user *filename, umode_t mode, return -EINVAL; lookup_flags = (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW; - name = getname_uflags(filename, flags); + CLASS(filename_uflags, name)(filename, flags); retry: error = filename_lookup(dfd, name, lookup_flags, &path, NULL); if (!error) { @@ -696,7 +693,6 @@ retry: goto retry; } } - putname(name); return error; } From e9817d5b8c32b64d40b0c0ffcd0dc67ce77e2aca Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 6 Dec 2025 12:51:13 -0500 Subject: [PATCH 58/68] namei.c: convert getname_kernel() callers to CLASS(filename_kernel) Signed-off-by: Al Viro --- fs/namei.c | 36 ++++++++++-------------------------- 1 file changed, 10 insertions(+), 26 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index ba6e15339ad6..1158beb9a399 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -3002,7 +3002,7 @@ drop: struct dentry *kern_path_parent(const char *name, struct path *path) { struct path parent_path __free(path_put) = {}; - struct filename *filename __free(putname) = getname_kernel(name); + CLASS(filename_kernel, filename)(name); struct dentry *d; struct qstr last; int type, error; @@ -3023,11 +3023,8 @@ struct dentry *kern_path_parent(const char *name, struct path *path) struct dentry *start_removing_path(const char *name, struct path *path) { - struct filename *filename = getname_kernel(name); - struct dentry *res = __start_removing_path(AT_FDCWD, filename, path); - - putname(filename); - return res; + CLASS(filename_kernel, filename)(name); + return __start_removing_path(AT_FDCWD, filename, path); } struct dentry *start_removing_user_path_at(int dfd, @@ -3044,12 +3041,8 @@ EXPORT_SYMBOL(start_removing_user_path_at); int kern_path(const char *name, unsigned int flags, struct path *path) { - struct filename *filename = getname_kernel(name); - int ret = filename_lookup(AT_FDCWD, filename, flags, path, NULL); - - putname(filename); - return ret; - + CLASS(filename_kernel, filename)(name); + return filename_lookup(AT_FDCWD, filename, flags, path, NULL); } EXPORT_SYMBOL(kern_path); @@ -3083,15 +3076,11 @@ int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt, const char *name, unsigned int flags, struct path *path) { - struct filename *filename; + CLASS(filename_kernel, filename)(name); struct path root = {.mnt = mnt, .dentry = dentry}; - int ret; - filename = getname_kernel(name); /* the first argument of filename_lookup() is ignored with root */ - ret = filename_lookup(AT_FDCWD, filename, flags, path, &root); - putname(filename); - return ret; + return filename_lookup(AT_FDCWD, filename, flags, path, &root); } EXPORT_SYMBOL(vfs_path_lookup); @@ -4888,13 +4877,12 @@ struct file *do_file_open_root(const struct path *root, { struct nameidata nd; struct file *file; - struct filename *filename; int flags = op->lookup_flags; if (d_is_symlink(root->dentry) && op->intent & LOOKUP_OPEN) return ERR_PTR(-ELOOP); - filename = getname_kernel(name); + CLASS(filename_kernel, filename)(name); if (IS_ERR(filename)) return ERR_CAST(filename); @@ -4905,7 +4893,6 @@ struct file *do_file_open_root(const struct path *root, if (unlikely(file == ERR_PTR(-ESTALE))) file = path_openat(&nd, op, flags | LOOKUP_REVAL); restore_nameidata(); - putname(filename); return file; } @@ -4961,11 +4948,8 @@ out: struct dentry *start_creating_path(int dfd, const char *pathname, struct path *path, unsigned int lookup_flags) { - struct filename *filename = getname_kernel(pathname); - struct dentry *res = filename_create(dfd, filename, path, lookup_flags); - - putname(filename); - return res; + CLASS(filename_kernel, filename)(pathname); + return filename_create(dfd, filename, path, lookup_flags); } EXPORT_SYMBOL(start_creating_path); From 904f58b50711babeb6e1383701e27d40a336908c Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 6 Dec 2025 13:01:06 -0500 Subject: [PATCH 59/68] namei.c: switch user pathname imports to CLASS(filename{,_flags}) filename_flags is used by user_path_at(). I suspect that mixing LOOKUP_EMPTY with real lookup flags had been a mistake all along; the former belongs to pathname import, the latter - to pathwalk. Right now none of the remaining in-tree callers of user_path_at() are getting LOOKUP_EMPTY in flags, so user_path_at() could probably be switched to CLASS(filename)... Signed-off-by: Al Viro --- fs/namei.c | 21 ++++++--------------- 1 file changed, 6 insertions(+), 15 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index 1158beb9a399..25c786ab0542 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -3031,11 +3031,8 @@ struct dentry *start_removing_user_path_at(int dfd, const char __user *name, struct path *path) { - struct filename *filename = getname(name); - struct dentry *res = __start_removing_path(dfd, filename, path); - - putname(filename); - return res; + CLASS(filename, filename)(name); + return __start_removing_path(dfd, filename, path); } EXPORT_SYMBOL(start_removing_user_path_at); @@ -3613,11 +3610,8 @@ int path_pts(struct path *path) int user_path_at(int dfd, const char __user *name, unsigned flags, struct path *path) { - struct filename *filename = getname_flags(name, flags); - int ret = filename_lookup(dfd, filename, flags, path, NULL); - - putname(filename); - return ret; + CLASS(filename_flags, filename)(name, flags); + return filename_lookup(dfd, filename, flags, path, NULL); } EXPORT_SYMBOL(user_path_at); @@ -4976,11 +4970,8 @@ inline struct dentry *start_creating_user_path( int dfd, const char __user *pathname, struct path *path, unsigned int lookup_flags) { - struct filename *filename = getname(pathname); - struct dentry *res = filename_create(dfd, filename, path, lookup_flags); - - putname(filename); - return res; + CLASS(filename, filename)(pathname); + return filename_create(dfd, filename, path, lookup_flags); } EXPORT_SYMBOL(start_creating_user_path); From cbe9e300a2c196ecb47d83e1665901603aca4126 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 14 Dec 2025 03:10:05 -0500 Subject: [PATCH 60/68] move_mount(2): switch to CLASS(filename_maybe_null) Signed-off-by: Al Viro --- fs/namespace.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index 888df8ee43bc..612757bd166a 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -4402,8 +4402,6 @@ SYSCALL_DEFINE5(move_mount, { struct path to_path __free(path_put) = {}; struct path from_path __free(path_put) = {}; - struct filename *to_name __free(putname) = NULL; - struct filename *from_name __free(putname) = NULL; unsigned int lflags, uflags; enum mnt_tree_flags_t mflags = 0; int ret = 0; @@ -4425,7 +4423,7 @@ SYSCALL_DEFINE5(move_mount, if (flags & MOVE_MOUNT_T_EMPTY_PATH) uflags = AT_EMPTY_PATH; - to_name = getname_maybe_null(to_pathname, uflags); + CLASS(filename_maybe_null,to_name)(to_pathname, uflags); if (!to_name && to_dfd >= 0) { CLASS(fd_raw, f_to)(to_dfd); if (fd_empty(f_to)) @@ -4448,7 +4446,7 @@ SYSCALL_DEFINE5(move_mount, if (flags & MOVE_MOUNT_F_EMPTY_PATH) uflags = AT_EMPTY_PATH; - from_name = getname_maybe_null(from_pathname, uflags); + CLASS(filename_maybe_null,from_name)(from_pathname, uflags); if (!from_name && from_dfd >= 0) { CLASS(fd_raw, f_from)(from_dfd); if (fd_empty(f_from)) From 57483461e19c55da9cd9433aed2d47949e8c1c11 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 14 Dec 2025 03:13:59 -0500 Subject: [PATCH 61/68] chroot(2): switch to CLASS(filename) Signed-off-by: Al Viro --- fs/open.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/fs/open.c b/fs/open.c index 3c7081694326..4adfd7e1975a 100644 --- a/fs/open.c +++ b/fs/open.c @@ -592,11 +592,11 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename) struct path path; int error; unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY; - struct filename *name = getname(filename); + CLASS(filename, name)(filename); retry: error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); if (error) - goto out; + return error; error = path_permission(&path, MAY_EXEC | MAY_CHDIR); if (error) @@ -606,19 +606,14 @@ retry: if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT)) goto dput_and_out; error = security_path_chroot(&path); - if (error) - goto dput_and_out; - - set_fs_root(current->fs, &path); - error = 0; + if (!error) + set_fs_root(current->fs, &path); dput_and_out: path_put(&path); if (retry_estale(error, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; goto retry; } -out: - putname(name); return error; } From ef7282e84934d54249abc745fc1cbc8b727a81cf Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 14 Dec 2025 03:17:33 -0500 Subject: [PATCH 62/68] quotactl_block(): switch to CLASS(filename) Signed-off-by: Al Viro --- fs/quota/quota.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/quota/quota.c b/fs/quota/quota.c index 7c2b75a44485..ed906725e183 100644 --- a/fs/quota/quota.c +++ b/fs/quota/quota.c @@ -867,7 +867,7 @@ static struct super_block *quotactl_block(const char __user *special, int cmd) { #ifdef CONFIG_BLOCK struct super_block *sb; - struct filename *tmp = getname(special); + CLASS(filename, tmp)(special); bool excl = false, thawed = false; int error; dev_t dev; @@ -875,7 +875,6 @@ static struct super_block *quotactl_block(const char __user *special, int cmd) if (IS_ERR(tmp)) return ERR_CAST(tmp); error = lookup_bdev(tmp->name, &dev); - putname(tmp); if (error) return ERR_PTR(error); From a4503461fb6b72c68dd341c4a8e286e1bf2ec265 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 14 Dec 2025 03:18:33 -0500 Subject: [PATCH 63/68] statx: switch to CLASS(filename_maybe_null) Signed-off-by: Al Viro --- fs/stat.c | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/fs/stat.c b/fs/stat.c index d18577f3688c..89909746bed1 100644 --- a/fs/stat.c +++ b/fs/stat.c @@ -365,17 +365,13 @@ retry: int vfs_fstatat(int dfd, const char __user *filename, struct kstat *stat, int flags) { - int ret; - int statx_flags = flags | AT_NO_AUTOMOUNT; - struct filename *name = getname_maybe_null(filename, flags); + CLASS(filename_maybe_null, name)(filename, flags); if (!name && dfd >= 0) return vfs_fstat(dfd, stat); - ret = vfs_statx(dfd, name, statx_flags, stat, STATX_BASIC_STATS); - putname(name); - - return ret; + return vfs_statx(dfd, name, flags | AT_NO_AUTOMOUNT, + stat, STATX_BASIC_STATS); } #ifdef __ARCH_WANT_OLD_STAT @@ -810,16 +806,12 @@ SYSCALL_DEFINE5(statx, unsigned int, mask, struct statx __user *, buffer) { - int ret; - struct filename *name = getname_maybe_null(filename, flags); + CLASS(filename_maybe_null, name)(filename, flags); if (!name && dfd >= 0) return do_statx_fd(dfd, flags & ~AT_NO_AUTOMOUNT, mask, buffer); - ret = do_statx(dfd, name, flags, mask, buffer); - putname(name); - - return ret; + return do_statx(dfd, name, flags, mask, buffer); } #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_STAT) From a0c3d1f3de375da1bcf2fb15d4d5a1e5ebf7b277 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 14 Dec 2025 03:19:28 -0500 Subject: [PATCH 64/68] user_statfs(): switch to CLASS(filename) Signed-off-by: Al Viro --- fs/statfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/statfs.c b/fs/statfs.c index a5671bf6c7f0..377bcef7a561 100644 --- a/fs/statfs.c +++ b/fs/statfs.c @@ -99,7 +99,7 @@ int user_statfs(const char __user *pathname, struct kstatfs *st) struct path path; int error; unsigned int lookup_flags = LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT; - struct filename *name = getname(pathname); + CLASS(filename, name)(pathname); retry: error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); if (!error) { @@ -110,7 +110,6 @@ retry: goto retry; } } - putname(name); return error; } From abb0434496c4299223f69bcb07174dee2e764bec Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 14 Dec 2025 03:20:01 -0500 Subject: [PATCH 65/68] mqueue: switch to CLASS(filename) Signed-off-by: Al Viro --- ipc/mqueue.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/ipc/mqueue.c b/ipc/mqueue.c index c4f6d65596cf..53a58f9ba01f 100644 --- a/ipc/mqueue.c +++ b/ipc/mqueue.c @@ -912,13 +912,12 @@ static struct file *mqueue_file_open(struct filename *name, static int do_mq_open(const char __user *u_name, int oflag, umode_t mode, struct mq_attr *attr) { - struct filename *name __free(putname) = NULL;; struct vfsmount *mnt = current->nsproxy->ipc_ns->mq_mnt; int fd, ro; audit_mq_open(oflag, mode, attr); - name = getname(u_name); + CLASS(filename, name)(u_name); if (IS_ERR(name)) return PTR_ERR(name); @@ -942,20 +941,19 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, umode_t, mode, SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name) { int err; - struct filename *name; struct dentry *dentry; struct inode *inode; struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns; struct vfsmount *mnt = ipc_ns->mq_mnt; + CLASS(filename, name)(u_name); - name = getname(u_name); if (IS_ERR(name)) return PTR_ERR(name); audit_inode_parent_hidden(name, mnt->mnt_root); err = mnt_want_write(mnt); if (err) - goto out_name; + return err; dentry = start_removing_noperm(mnt->mnt_root, &QSTR(name->name)); if (IS_ERR(dentry)) { err = PTR_ERR(dentry); @@ -971,9 +969,6 @@ SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name) out_drop_write: mnt_drop_write(mnt); -out_name: - putname(name); - return err; } From 39537a335a61894bbfd3dbb413f0c52bdf03772e Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 14 Dec 2025 03:21:15 -0500 Subject: [PATCH 66/68] ksmbd: use CLASS(filename_kernel) Signed-off-by: Al Viro --- fs/smb/server/vfs.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c index 30b65b667b96..523bc7f942ad 100644 --- a/fs/smb/server/vfs.c +++ b/fs/smb/server/vfs.c @@ -54,7 +54,6 @@ static int ksmbd_vfs_path_lookup(struct ksmbd_share_config *share_conf, struct path *path, bool for_remove) { struct qstr last; - struct filename *filename __free(putname) = NULL; const struct path *root_share_path = &share_conf->vfs_path; int err, type; struct dentry *d; @@ -66,7 +65,7 @@ static int ksmbd_vfs_path_lookup(struct ksmbd_share_config *share_conf, flags |= LOOKUP_BENEATH; } - filename = getname_kernel(pathname); + CLASS(filename_kernel, filename)(pathname); err = vfs_path_parent_lookup(filename, flags, path, &last, &type, root_share_path); @@ -664,7 +663,6 @@ int ksmbd_vfs_rename(struct ksmbd_work *work, const struct path *old_path, struct path new_path; struct qstr new_last; struct renamedata rd; - struct filename *to; struct ksmbd_share_config *share_conf = work->tcon->share_conf; struct ksmbd_file *parent_fp; int new_type; @@ -673,7 +671,7 @@ int ksmbd_vfs_rename(struct ksmbd_work *work, const struct path *old_path, if (ksmbd_override_fsids(work)) return -ENOMEM; - to = getname_kernel(newname); + CLASS(filename_kernel, to)(newname); retry: err = vfs_path_parent_lookup(to, lookup_flags | LOOKUP_BENEATH, @@ -732,7 +730,6 @@ out2: goto retry; } out1: - putname(to); ksmbd_revert_fsids(work); return err; } From 9b323d2f474071cc6c627f73af301ba6f5e2b83f Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 14 Dec 2025 03:26:56 -0500 Subject: [PATCH 67/68] alpha: switch osf_mount() to strndup_user() ... same as native mount(2) is doing for devname argument. While we are at it, fix misspelling ufs_args as cdfs_args in osf_ufs_mount() - layouts are identical, so it doesn't change anything, but the current variant is confusing for no reason. Signed-off-by: Al Viro --- arch/alpha/kernel/osf_sys.c | 34 +++++++++++----------------------- 1 file changed, 11 insertions(+), 23 deletions(-) diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c index a08e8edef1a4..7b6543d2cca3 100644 --- a/arch/alpha/kernel/osf_sys.c +++ b/arch/alpha/kernel/osf_sys.c @@ -454,42 +454,30 @@ static int osf_ufs_mount(const char __user *dirname, struct ufs_args __user *args, int flags) { - int retval; - struct cdfs_args tmp; - struct filename *devname; + struct ufs_args tmp; + char *devname __free(kfree) = NULL; - retval = -EFAULT; if (copy_from_user(&tmp, args, sizeof(tmp))) - goto out; - devname = getname(tmp.devname); - retval = PTR_ERR(devname); + return -EFAULT; + devname = strndup_user(tmp.devname, PATH_MAX); if (IS_ERR(devname)) - goto out; - retval = do_mount(devname->name, dirname, "ext2", flags, NULL); - putname(devname); - out: - return retval; + return PTR_ERR(devname); + return do_mount(devname, dirname, "ext2", flags, NULL); } static int osf_cdfs_mount(const char __user *dirname, struct cdfs_args __user *args, int flags) { - int retval; struct cdfs_args tmp; - struct filename *devname; + char *devname __free(kfree) = NULL; - retval = -EFAULT; if (copy_from_user(&tmp, args, sizeof(tmp))) - goto out; - devname = getname(tmp.devname); - retval = PTR_ERR(devname); + return -EFAULT; + devname = strndup_user(tmp.devname, PATH_MAX); if (IS_ERR(devname)) - goto out; - retval = do_mount(devname->name, dirname, "iso9660", flags, NULL); - putname(devname); - out: - return retval; + return PTR_ERR(devname); + return do_mount(devname, dirname, "iso9660", flags, NULL); } static int From 0787a93baa1aab9fd0cb8500105d11d3d3a58f7a Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 14 Dec 2025 03:32:45 -0500 Subject: [PATCH 68/68] sysfs(2): fs_index() argument is _not_ a pathname ... it's a filesystem type name. Signed-off-by: Al Viro --- fs/filesystems.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/filesystems.c b/fs/filesystems.c index 95e5256821a5..0c7d2b7ac26c 100644 --- a/fs/filesystems.c +++ b/fs/filesystems.c @@ -132,24 +132,21 @@ EXPORT_SYMBOL(unregister_filesystem); static int fs_index(const char __user * __name) { struct file_system_type * tmp; - struct filename *name; + char *name __free(kfree) = strndup_user(__name, PATH_MAX); int err, index; - name = getname(__name); - err = PTR_ERR(name); if (IS_ERR(name)) - return err; + return PTR_ERR(name); err = -EINVAL; read_lock(&file_systems_lock); for (tmp=file_systems, index=0 ; tmp ; tmp=tmp->next, index++) { - if (strcmp(tmp->name, name->name) == 0) { + if (strcmp(tmp->name, name) == 0) { err = index; break; } } read_unlock(&file_systems_lock); - putname(name); return err; }