[PATCH v4 0/3] nvmet: avoid recursive configfs open

From: Runyu Xiao

Date: Mon Sep 21 2026 - 05:07:38 EST


The nvmet configfs store callbacks hold the item's frag_sem while they
enable file-backed namespaces or passthru controllers. Both paths open a
user-configured pathname. If it resolves into configfs, the open path can
re-enter __configfs_open_file() and try to acquire the same frag_sem again.

Add configfs helpers that resolve configured paths, reject configfs-backed
paths, and open the resolved path with file_open_root(). This keeps the
normal open-time permission and security checks while preventing the
recursive configfs open.

Changes since v3:
- Move path lookup, configfs rejection, and file_open_root() into the
configfs helper, as requested by Christoph Hellwig.
- Use the helper from both nvmet backend open paths.
- Provide a root-relative helper for callers that retain a resolved root,
including callers that create files below a pinned root.
- Drop the previous Reviewed-by tags because the helper interface changed.

Runyu Xiao (3):
fs: configfs: add helpers for opening non-configfs paths
nvmet: avoid recursive configfs open for file-backed namespaces
nvmet: avoid recursive configfs open for passthru

drivers/nvme/target/io-cmd-file.c | 3 ++-
drivers/nvme/target/passthru.c | 3 ++-
fs/configfs/mount.c | 33 +++++++++++++++++++++++++++++++
include/linux/configfs.h | 6 ++++++
4 files changed, 43 insertions(+), 2 deletions(-)


base-commit: df2908090cda368b01ff43709f51890076c56157
--
2.34.1