Re: [PATCH v2] bpf: have bpf_real_data_inode() take a struct file

[Amir Goldstein]

On Tue, Jun 23, 2026 at 11:32 AM Christian Brauner <brauner@xxxxxxxxxx> wrote:
>
> bpf_real_data_inode() must be usable from the bprm_check_security,
> mmap_file and file_mprotect hooks for systemd's RestrictFilesystemAccess
> BPF LSM program, so have it take a struct file instead of a dentry.
>
> Amir Goldstein <amir73il@xxxxxxxxx> suggests:
>
>   While doing so, rename it from bpf_real_inode() to
>   bpf_real_data_inode(). For a regular file on a union/overlay
>   filesystem it resolves to the underlying inode that hosts the data,
>   but for a non-regular file it returns the overlay inode. The new name
>   makes the "inode hosting the data" intent explicit and avoids the
>   ambiguity of "the real inode backing a file". Document the
>   non-regular-file behavior in the kfunc too.
>
> Both the signature change and the rename are safe because the kfunc
> landed this cycle and has no released users.
>
> Fixes: 9af8c8a54f6e ("bpf: add bpf_real_inode() kfunc")
> Signed-off-by: Christian Brauner (Amutable) <brauner@xxxxxxxxxx>

Reviewed-by: Amir Goldstein <amir73il@xxxxxxxxx>

> ---
> Changes in v2:
> - Rename bpf_real_inode() -> bpf_real_data_inode() (Amir); the new name
>   makes the "inode hosting the data" intent explicit.
> - Document that the kfunc returns the overlay inode for non-regular files.
> - Link to v1: https://patch.msgid.link/20260622-work-bpf-real_inode-v1-1-4014eb4cbefd@xxxxxxxxxx
> ---
>  fs/bpf_fs_kfuncs.c | 23 ++++++++++++++---------
>  1 file changed, 14 insertions(+), 9 deletions(-)
>
> diff --git a/fs/bpf_fs_kfuncs.c b/fs/bpf_fs_kfuncs.c
> index 768aca2dc0f0..f1863a891db6 100644
> --- a/fs/bpf_fs_kfuncs.c
> +++ b/fs/bpf_fs_kfuncs.c
> @@ -360,18 +360,23 @@ __bpf_kfunc int bpf_cgroup_read_xattr(struct cgroup *cgroup, const char *name__s
>  #endif /* CONFIG_CGROUPS */
>
>  /**
> - * bpf_real_inode - get the real inode backing a dentry
> - * @dentry: dentry to resolve
> + * bpf_real_data_inode - get the real inode hosting a file's data
> + * @file: file to resolve
>   *
> - * If the dentry is on a union/overlay filesystem, return the underlying, real
> - * inode that hosts the data.  Otherwise return the inode attached to the
> - * dentry itself.
> + * Resolve @file to the inode that hosts its data. For a regular file on a
> + * union/overlay filesystem this is the underlying (upper or lower) inode that
> + * stores the data, not the overlay inode.
>   *
> - * Return: The real inode backing the dentry, or NULL for a negative dentry.
> + * Data resolution only applies to regular files. For a non-regular file (e.g.
> + * a device node, fifo or socket) on a union/overlay filesystem the overlay
> + * inode itself is returned; for any file on a non-union filesystem the inode
> + * attached to @file is returned.
> + *
> + * Return: The inode hosting @file's data, or NULL.
>   */
> -__bpf_kfunc struct inode *bpf_real_inode(struct dentry *dentry)
> +__bpf_kfunc struct inode *bpf_real_data_inode(struct file *file)
>  {
> -       return d_real_inode(dentry);
> +       return d_real_inode(file_dentry(file));
>  }
>
>  __bpf_kfunc_end_defs();
> @@ -384,7 +389,7 @@ BTF_ID_FLAGS(func, bpf_get_dentry_xattr, KF_SLEEPABLE)
>  BTF_ID_FLAGS(func, bpf_get_file_xattr, KF_SLEEPABLE)
>  BTF_ID_FLAGS(func, bpf_set_dentry_xattr, KF_SLEEPABLE)
>  BTF_ID_FLAGS(func, bpf_remove_dentry_xattr, KF_SLEEPABLE)
> -BTF_ID_FLAGS(func, bpf_real_inode, KF_SLEEPABLE | KF_RET_NULL)
> +BTF_ID_FLAGS(func, bpf_real_data_inode, KF_SLEEPABLE | KF_RET_NULL)
>  BTF_KFUNCS_END(bpf_fs_kfunc_set_ids)
>
>  static int bpf_fs_kfuncs_filter(const struct bpf_prog *prog, u32 kfunc_id)
>
> ---
> base-commit: 5b33fc6492a7b7a62359157db0f92f5b6e9af690
> change-id: 20260622-work-bpf-real_inode-c3202dbaf0ab
>