Re: [PATCH] super: make iterate_supers_type() deletion-safe

[Christian Brauner]

On Sat, Sep 05, 2026 at 08:31:32AM +0200, Karl Mehltretter wrote:
> On Fri, Sep 04, 2026 at 01:11:53PM +0100, Christian Brauner wrote:
> > 
> > Draft, feel free to grab, Jan or Karl.
> > 
> > ---
> >  fs/kernfs/mount.c |  4 ++--
> >  fs/super.c        | 39 +++++++++++++++++++--------------------
> >  2 files changed, 21 insertions(+), 22 deletions(-)
> > 
> 
> Thanks, I found no issues with your draft.
> All the tests I ran on my patch also pass with your draft.
> 
> Below is my proposed changelog. If it looks good, I'll send v2 with you as
> author. Could you provide your Signed-off-by?
> 
> super: make iterate_supers_type() deletion-safe
> 
> iterate_supers_type() drops sb_lock while invoking the callback and keeps
> only a passive reference to the current superblock. That reference keeps
> the object allocated, but does not keep its s_instances node linked.
> 
> After the iterator releases s_umount, final teardown can unlink the current
> s_instances node. The iterator then advances through a reinitialized node.
> With the current hlist it stops without visiting the remaining superblocks.
> The unlink moved from generic_shutdown_super() to kill_super_notify(), but
> the cursor lifetime has been unsafe since the helper was introduced.
> 
> The CIFS DFS lookup can consequently miss a matching superblock and return
> -EINVAL.
> 
> Move removal from fs_supers to put_super(), alongside removal from
> super_blocks, so a passive reference keeps both list nodes linked. Keep
> the filesystem module reference until then, since unlinking s_instances
> may touch type->fs_supers.
> 
> Make sget_fc() skip SB_DEAD superblocks before invoking test(), and set
> SB_DEAD under sb_lock to serialize with those callbacks. This allows
> kernfs to free its private information after kill_anon_super() returns.
> Keep matching SB_DYING superblocks until SB_DEAD is set so concurrent
> mounts still wait for teardown before retrying.
> 
> Fixes: 43e15cdbefea ("new helper: iterate_supers_type()")
> Reported-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
> Suggested-by: Jan Kara <jack@xxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> <your Signed-off-by>
> Tested-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
> Assisted-by: LLM
> <my Signed-off-by>

Sure,
Signed-off-by: Christian Brauner (Amutable) <brauner@xxxxxxxxxx>