Re: [PATCH v3] fs: let backing files inherit FMODE_NONOTIFY from the user file

[Edvard Conrad]

On Fri, Oct 30, 2026 at 6:13 PM Amir Goldstein <amir73il@xxxxxxxxx> wrote:
> Would you mind adding test cases (or variants) to fanotify26 to cover
> this find and test the attached (sanity tested only) patch.

Two things on the directory side, one settled and one not.

Agreed on 130fdbc3d1f99 ("ovl: pass correct flags for opening real
directory"). Before it ovl_dir_open() passed the user file's f_flags to
ovl_path_open(), and __FMODE_NONOTIFY travelled with them; the commit
reasons through every O_* flag but that one is not an O_* flag. That
fits v6.13 failing the directory case and passing the file case.

The one that is not settled: with your patch, listing a merged
directory through the event fd still deadlocks. ovl_iterate() sends a
directory that has OVL_WHITEOUTS to ovl_iterate_merged(), and
ovl_dir_read() opens each layer with plain ovl_path_open(), which no
user file reaches. A listener that calls getdents64() on the fd before
answering blocks here:

  fanotify_handle_event
  fsnotify
  fsnotify_open_perm_and_set_mode
  do_dentry_open
  vfs_open
  dentry_open
  ovl_dir_read_merged
  ovl_iterate
  iterate_dir
  __x64_sys_getdents64

Two controls on the same kernel: the same merged directory without the
listing passes, and a lower-only directory with the listing passes,
since od->realfile is nonotify with your patch and iterate_dir() uses
it directly. That was on 6b4b543fa18 with your patch applied (with some
fuzz); the readdir.c paths involved are the same in today's master. I
have it as an extra case in a local copy of fanotify26 and can post it
once there is a fix to run it against.

Incidentally, I was thinking about your ask for something more
generic: a task-level "creating an event fd" state in fanotify would
cover the file and directory opens in one place, and the copy-up opens
in copy_up.c too, which also go through plain ovl_path_open() and
which an O_RDWR group would trigger for a lower-only file (from
reading, not tested). It would not reach the listing case above, which
runs at getdents() time, long after the fd exists.

Thanks,
Edvard