Re: [PATCH] super: make iterate_supers_type() deletion-safe

[Karl Mehltretter]

On Fri, Sep 04, 2026 at 01:11:53PM +0100, Christian Brauner wrote:
> 
> Draft, feel free to grab, Jan or Karl.
> 
> ---
>  fs/kernfs/mount.c |  4 ++--
>  fs/super.c        | 39 +++++++++++++++++++--------------------
>  2 files changed, 21 insertions(+), 22 deletions(-)
> 

Thanks, I found no issues with your draft.
All the tests I ran on my patch also pass with your draft.

Below is my proposed changelog. If it looks good, I'll send v2 with you as
author. Could you provide your Signed-off-by?

super: make iterate_supers_type() deletion-safe

iterate_supers_type() drops sb_lock while invoking the callback and keeps
only a passive reference to the current superblock. That reference keeps
the object allocated, but does not keep its s_instances node linked.

After the iterator releases s_umount, final teardown can unlink the current
s_instances node. The iterator then advances through a reinitialized node.
With the current hlist it stops without visiting the remaining superblocks.
The unlink moved from generic_shutdown_super() to kill_super_notify(), but
the cursor lifetime has been unsafe since the helper was introduced.

The CIFS DFS lookup can consequently miss a matching superblock and return
-EINVAL.

Move removal from fs_supers to put_super(), alongside removal from
super_blocks, so a passive reference keeps both list nodes linked. Keep
the filesystem module reference until then, since unlinking s_instances
may touch type->fs_supers.

Make sget_fc() skip SB_DEAD superblocks before invoking test(), and set
SB_DEAD under sb_lock to serialize with those callbacks. This allows
kernfs to free its private information after kill_anon_super() returns.
Keep matching SB_DYING superblocks until SB_DEAD is set so concurrent
mounts still wait for teardown before retrying.

Fixes: 43e15cdbefea ("new helper: iterate_supers_type()")
Reported-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
Suggested-by: Jan Kara <jack@xxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
<your Signed-off-by>
Tested-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
Assisted-by: LLM
<my Signed-off-by>

Thanks,
Karl