summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-01-16ksmbd: use CLASS(filename_kernel)Al Viro1-5/+2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16mqueue: switch to CLASS(filename)Al Viro1-8/+3
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16user_statfs(): switch to CLASS(filename)Al Viro1-2/+1
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16statx: switch to CLASS(filename_maybe_null)Al Viro1-13/+5
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16quotactl_block(): switch to CLASS(filename)Al Viro1-2/+1
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16chroot(2): switch to CLASS(filename)Al Viro1-9/+4
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16move_mount(2): switch to CLASS(filename_maybe_null)Al Viro1-4/+2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16namei.c: switch user pathname imports to CLASS(filename{,_flags})Al Viro1-15/+6
filename_flags is used by user_path_at(). I suspect that mixing LOOKUP_EMPTY with real lookup flags had been a mistake all along; the former belongs to pathname import, the latter - to pathwalk. Right now none of the remaining in-tree callers of user_path_at() are getting LOOKUP_EMPTY in flags, so user_path_at() could probably be switched to CLASS(filename)... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16namei.c: convert getname_kernel() callers to CLASS(filename_kernel)Al Viro1-26/+10
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16do_f{chmod,chown,access}at(): use CLASS(filename_uflags)Al Viro1-6/+2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16do_readlinkat(): switch to CLASS(filename_flags)Al Viro1-6/+2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16do_sys_truncate(): switch to CLASS(filename)Al Viro1-7/+5
Note that failures from filename_lookup() are final - ESTALE returned by it means that retry had been done by filename_lookup() and it failed there. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16do_utimes_path(): switch to CLASS(filename_uflags)Al Viro1-5/+2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16chdir(2): unspaghettify a bit...Al Viro1-17/+10
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16do_fchownat(): unspaghettify a bit...Al Viro1-16/+12
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16fspick(2): use CLASS(filename_flags)Al Viro1-3/+3
That kills the last place where we mix LOOKUP_EMPTY with lookup flags proper. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16name_to_handle_at(): use CLASS(filename_uflags)Al Viro1-3/+2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16vfs_open_tree(): use CLASS(filename_uflags)Al Viro1-3/+2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16do_open_execat(): don't care about LOOKUP_EMPTYAl Viro1-2/+0
do_file_open() doesn't. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16mount_setattr(2): don't mess with LOOKUP_EMPTYAl Viro1-3/+2
just use CLASS(filename_uflags) + filename_lookup() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16file_[gs]etattr(2): switch to CLASS(filename_maybe_null)Al Viro1-4/+2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16filename_...xattr(): don't consume filename referenceAl Viro2-29/+12
Callers switched to CLASS(filename_maybe_null) (in fs/xattr.c) and CLASS(filename_complete_delayed) (in io_uring/xattr.c). Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16non-consuming variants of do_{unlinkat,rmdir}()Al Viro6-22/+26
similar to previous commit; replacements are filename_{unlinkat,rmdir}() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16non-consuming variant of do_mknodat()Al Viro4-12/+12
similar to previous commit; replacement is filename_mknodat() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16non-consuming variant of do_mkdirat()Al Viro5-11/+12
similar to previous commit; replacement is filename_mkdirat() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16non-consuming variant of do_symlinkat()Al Viro5-18/+20
similar to previous commit; replacement is filename_symlinkat() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16non-consuming variant of do_linkat()Al Viro5-21/+20
similar to previous commit; replacement is filename_linkat() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16non-consuming variant of do_renameat2()Al Viro4-19/+29
filename_renameat2() replaces do_renameat2(); unlike the latter, it does not drop filename references - these days it can be just as easily arranged in the caller. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13switch {alloc,free}_bprm() to CLASS()Al Viro1-27/+21
All linux_binprm instances come from alloc_bprm() and are unconditionally destroyed by free_bprm() in the end of the same scope. IOW, CLASS() machinery is a decent fit for those. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13do_execveat_common(): don't consume filename referenceAl Viro1-15/+12
... and convert its callers to CLASS(filename...) Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13execve: fold {compat_,}do_execve{,at}() into their sole callersAl Viro1-61/+19
All of them are wrappers for do_execveat_common() and each has exactly one caller. The only difference is in the way they are constructing argv/envp arguments for do_execveat_common() and that's easy to do with less boilerplate. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13simplify the callers of alloc_bprm()Al Viro1-14/+3
alloc_bprm() starts with do_open_execat() and it will do the right thing if given ERR_PTR() for name. Allows to drop such checks in its callers... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13simplify the callers of do_open_execat()Al Viro1-8/+2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13simplify the callers of file_open_name()Al Viro4-41/+9
It accepts ERR_PTR() for name and does the right thing in that case. That allows to simplify the logics in callers, making them trivial to switch to CLASS(filename). Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13do_sys_openat2(): get rid of useless check, switch to CLASS(filename)Al Viro1-9/+3
do_file_open() will do the right thing when given ERR_PTR() as name... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13rename do_filp_open() to do_file_open()Al Viro5-6/+6
"filp" thing never made sense; seeing that there are exactly 4 callers in the entire tree (and it's neither exported nor even declared in linux/*/*.h), there's no point keeping that ugliness. FWIW, the 'filp' thing did originate in OSD&I; for some reason Tanenbaum decided to call the object representing an opened file 'struct filp', the last letter standing for 'position'. In all Unices, Linux included, the corresponding object had always been 'struct file'... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13do_filp_open(): DTRT when getting ERR_PTR() as pathnameAl Viro1-0/+2
The rest of the set_nameidata() callers treat IS_ERR(pathname) as "bail out immediately with PTR_ERR(pathname) as error". Makes life simpler for callers; do_filp_open() is the only exception and its callers would also benefit from such calling conventions change. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as nameAl Viro1-5/+0
no need to check in the caller Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13ksmbd_vfs_path_lookup(): vfs_path_parent_lookup() accepts ERR_PTR() as nameAl Viro1-3/+0
no need to check in the caller Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13move_mount(): filename_lookup() accepts ERR_PTR() as filenameAl Viro1-6/+0
no need to check it in the caller Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13file_setattr(): filename_lookup() accepts ERR_PTR() as filenameAl Viro1-3/+0
no need to check it in the caller Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13file_getattr(): filename_lookup() accepts ERR_PTR() as filenameAl Viro1-3/+0
no need to check it in the caller Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13struct filename ->refcnt doesn't need to be atomicAl Viro3-16/+10
... or visible outside of audit, really. Note that references held in delayed_filename always have refcount 1, and from the moment of complete_getname() or equivalent point in getname...() there won't be any references to struct filename instance left in places visible to other threads. Acked-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13allow incomplete imports of filenamesAl Viro6-95/+157
There are two filename-related problems in io_uring and its interplay with audit. Filenames are imported when request is submitted and used when it is processed. Unfortunately, the latter may very well happen in a different thread. In that case the reference to filename is put into the wrong audit_context - that of submitting thread, not the processing one. Audit logics is called by the latter, and it really wants to be able to find the names in audit_context current (== processing) thread. Another related problem is the headache with refcounts - normally all references to given struct filename are visible only to one thread (the one that uses that struct filename). io_uring violates that - an extra reference is stashed in audit_context of submitter. It gets dropped when submitter returns to userland, which can happen simultaneously with processing thread deciding to drop the reference it got. We paper over that by making refcount atomic, but that means pointless headache for everyone. Solution: the notion of partially imported filenames. Namely, already copied from userland, but *not* exposed to audit yet. io_uring can create that in submitter thread, and complete the import (obtaining the usual reference to struct filename) in processing thread. Object: struct delayed_filename. Primitives for working with it: delayed_getname(&delayed_filename, user_string) - copies the name from userland, returning 0 and stashing the address of (still incomplete) struct filename in delayed_filename on success and returning -E... on error. delayed_getname_uflags(&delayed_filename, user_string, atflags) - similar, in the same relation to delayed_getname() as getname_uflags() is to getname() complete_getname(&delayed_filename) - completes the import of filename stashed in delayed_filename and returns struct filename to caller, emptying delayed_filename. CLASS(filename_complete_delayed, name)(&delayed_filename) - variant of CLASS(filename) with complete_getname() for constructor. dismiss_delayed_filename(&delayed_filename) - destructor; drops whatever might be stashed in delayed_filename, emptying it. putname_to_delayed(&delayed_filename, name) - if name is shared, stashes its copy into delayed_filename and drops the reference to name, otherwise stashes the name itself in there. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13switch __getname_maybe_null() to CLASS(filename_flags)Al Viro1-7/+5
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13fs: hide names_cache behind runtime const machineryMateusz Guzik2-7/+12
s/names_cachep/names_cache/ for consistency with dentry cache. Signed-off-by: Mateusz Guzik <mjguzik@gmail.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13struct filename: saner handling of long namesAl Viro2-56/+41
Always allocate struct filename from names_cachep, long name or short; short names would be embedded into struct filename. Longer ones do not cannibalize the original struct filename - put them into kmalloc'ed buffers (PATH_MAX-sized for import from userland, strlen() + 1 - for ones originating kernel-side, where we know the length beforehand). Cutoff length for short names is chosen so that struct filename would be 192 bytes long - that's both a multiple of 64 and large enough to cover the majority of real-world uses. Simplifies logics in getname()/putname() and friends. [fixed an embarrassing braino in EMBEDDED_NAME_MAX, first reported by Dan Carpenter] Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13struct filename: use names_cachep only for getname() and friendsAl Viro4-20/+33
Instances of struct filename come from names_cachep (via __getname()). That is done by getname_flags() and getname_kernel() and these two are the main callers of __getname(). However, there are other callers that simply want to allocate PATH_MAX bytes for uses that have nothing to do with struct filename. We want saner allocation rules for long pathnames, so that struct filename would *always* come from names_cachep, with the out-of-line pathname getting kmalloc'ed. For that we need to be able to change the size of objects allocated by getname_flags()/getname_kernel(). That requires the rest of __getname() users to stop using names_cachep; we could explicitly switch all of those to kmalloc(), but that would cause quite a bit of noise. So the plan is to switch getname_...() to new helpers and turn __getname() into a wrapper for kmalloc(). Remaining __getname() users could be converted to explicit kmalloc() at leisure, hopefully along with figuring out what size do they really want - PATH_MAX is an overkill for some of them, used out of laziness ("we have a convenient helper that does 4K allocations and that's large enough, let's use it"). As a side benefit, names_cachep is no longer used outside of fs/namei.c, so we can move it there and be done with that. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13getname_flags() massage, part 2Al Viro1-27/+29
Take the "long name" case into a helper (getname_long()). In case of failure have the caller deal with freeing the original struct filename. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-13getname_flags() massage, part 1Al Viro1-17/+16
In case of long name don't reread what we'd already copied. memmove() it instead. That avoids the possibility of ending up with empty name there and the need to look at the flags on the slow path. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
generated by cgit v1.2.3 (git 2.39.0) at 2026-05-03 21:23:56 +0300