[PATCH 0/2] nvmet: avoid configfs recursion when enabling backends
From: Runyu Xiao
Date: Mon Aug 17 2026 - 11:22:01 EST
The nvmet configfs store callbacks run while configfs holds the item's
frag_sem. Two enable paths then call filp_open() on user-controlled
paths:
- file-backed namespace enable via device_path
- passthru controller enable via passthru_ctrl_path
If either path points back into configfs, the open path re-enters
__configfs_open_file() and tries to take the same frag_sem again.
Resolve the configured path before opening it, reject configfs-backed
paths, and use dentry_open() on the resolved path. This prevents the
configfs recursion without changing valid backend users.
Runyu Xiao (2):
nvmet: avoid recursive configfs open for file-backed namespaces
nvmet: avoid recursive configfs open for passthru
drivers/nvme/target/io-cmd-file.c | 19 ++++++++++++++++++-
drivers/nvme/target/passthru.c | 17 ++++++++++++++++-
2 files changed, 34 insertions(+), 2 deletions(-)
--
2.34.1