On Mon, Jun 30, 2025 at 08:20:59AM +0100, Al Viro wrote:
> [In #fixes, I'll send a pull request in a few days unless anybody objects]
>
> There's one case where ->d_compare() can be called for an in-lookup
> dentry; usually that's nothing special from ->d_compare() point of
> view, but proc_sys_compare() is... unique.
>
> The thing is, /proc/sys subdirectories can look differently for
> different processes. Up to and including having the same name
> resolve to different dentries - all of them hashed.
>
> The way it's done is ->d_compare() refusing to admit a match unless
> this dentry is supposed to be visible to this caller. The information
> needed to discriminate between them is stored in inode; it is set
> during proc_sys_lookup() and until it's done d_splice_alias() we really
> can't tell who should that dentry be visible for.
>
> Normally there's no negative dentries in /proc/sys; we can run into
> a dying dentry in RCU dcache lookup, but those can be safely rejected.
>
> However, ->d_compare() is also called for in-lookup dentries, before
> they get positive - or hashed, for that matter. In case of match
> we will wait until dentry leaves in-lookup state and repeat ->d_compare()
> afterwards. In other words, the right behaviour is to treat the
> name match as sufficient for in-lookup dentries; if dentry is not
> for us, we'll see that when we recheck once proc_sys_lookup() is
> done with it.
>
> Fixes: d9171b934526 ("parallel lookups machinery, part 4 (and last)")
> Reported-by: NeilBrown <neilb@xxxxxxxxxx>
> Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
> ---
Reviewed-by: Christian Brauner <brauner@xxxxxxxxxx>
