[PATCH v4 0/2] ocfs2: stabilize dentry names in file and setattr traces
From: Cen Zhang
Date: Thu Oct 22 2026 - 05:15:06 EST
Snapshot names at all six users of ocfs2__file_ops and at the separate
setattr event. Patch 1 handles the five ordinary file-operation callers
and setattr. Patch 2 handles release separately to preserve its locked
open-count sample and take the snapshot outside that critical section.
The release explanation distinguishes its existing RCU lifetime coverage
from name/length consistency. It does not claim that the ordinary
callers' external-name UAF interleaving crosses the held inode spinlock.
The release source change is unchanged from v3.
Patch 1 also removes the read callback's redundant NULL-inode check.
The two patches apply independently and leave trace formats unchanged.
Cen Zhang (2):
ocfs2: snapshot dentry names in file and setattr traces
ocfs2: snapshot the dentry name while tracing file release
fs/ocfs2/file.c | 118 +++++++++++++++++++++++++++++++-----------------
1 file changed, 77 insertions(+), 41 deletions(-)
---
Changes in v4:
- Add a name snapshot to the separate setattr event, including the
same-directory source-directory rename case missed in v3.
- Remove the redundant NULL-inode check from ocfs2_file_read_iter().
- Clarify that release can select external names but its held spinlock
already delays their RCU reclamation; retain the inline-name/name-length
consistency rationale and the unchanged release source fix.
Changes in v3:
- Cover all six ocfs2__file_ops call sites with two patches, grouping open,
fsync, read, write and splice-read and handling release separately.
- For release, keep the trace and open-count sample under oi->ip_lock while
taking and releasing the snapshot outside that lock; cache the
event-enabled check.
Changes in v2:
- Replace d_lock around the tracepoint with a dentry name snapshot so trace
callbacks run without the caller holding the dentry lock.
- Pass both the name and its length from the snapshot; keep the event
enabled check and release the snapshot after the trace call.
Link to v1: https://lore.kernel.org/r/pm-ocfs2-objects-candidate-0088-v3-d628f98bfcb6784a0bfb@xxxxxxxxx
Link to v2: https://lore.kernel.org/r/pm-ocfs2-objects-candidate-0088-v4-a9a0df898afb4fc65fa0@xxxxxxxxx
Link to v3: https://lore.kernel.org/r/pm-ocfs2-objects-candidate-0088-v6-d3056754af7e660155d9-0@xxxxxxxxx