[PATCH 0/2] nvmet: avoid configfs recursion when enabling backends

From: Runyu Xiao

Date: Mon Aug 17 2026 - 11:22:01 EST


The nvmet configfs store callbacks run while configfs holds the item's
frag_sem. Two enable paths then call filp_open() on user-controlled
paths:

- file-backed namespace enable via device_path
- passthru controller enable via passthru_ctrl_path

If either path points back into configfs, the open path re-enters
__configfs_open_file() and tries to take the same frag_sem again.

Resolve the configured path before opening it, reject configfs-backed
paths, and use dentry_open() on the resolved path. This prevents the
configfs recursion without changing valid backend users.

Runyu Xiao (2):
nvmet: avoid recursive configfs open for file-backed namespaces
nvmet: avoid recursive configfs open for passthru

drivers/nvme/target/io-cmd-file.c | 19 ++++++++++++++++++-
drivers/nvme/target/passthru.c | 17 ++++++++++++++++-
2 files changed, 34 insertions(+), 2 deletions(-)

--
2.34.1