On Wed, 2026-02-04 at 15:57 +1100, NeilBrown wrote:
> From: NeilBrown <[email protected]>
>
> Instead of explicitly locking the parent and performing a look up in
> apparmor, use simple_start_creating(), and then simple_done_creating()
> to unlock and drop the dentry.
>
> This removes the need to check for an existing entry (as
> simple_start_creating() acts like an exclusive create and can return
> -EEXIST), simplifies error paths, and keeps dir locking code
> centralised.
>
> Signed-off-by: NeilBrown <[email protected]>
> ---
> security/apparmor/apparmorfs.c | 38 ++++++++--------------------------
> 1 file changed, 9 insertions(+), 29 deletions(-)
>
> diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
> index 907bd2667e28..7f78c36e6e50 100644
> --- a/security/apparmor/apparmorfs.c
> +++ b/security/apparmor/apparmorfs.c
> @@ -282,32 +282,19 @@ static struct dentry *aafs_create(const char *name,
> umode_t mode,
>
> dir = d_inode(parent);
>
> - inode_lock(dir);
> - dentry = lookup_noperm(&QSTR(name), parent);
> + dentry = simple_start_creating(parent, name);
> if (IS_ERR(dentry)) {
> error = PTR_ERR(dentry);
> - goto fail_lock;
> - }
> -
> - if (d_really_is_positive(dentry)) {
> - error = -EEXIST;
> - goto fail_dentry;
> + goto fail;
> }
>
> error = __aafs_setup_d_inode(dir, dentry, mode, data, link, fops, iops);
> + simple_done_creating(dentry);
> if (error)
> - goto fail_dentry;
> - inode_unlock(dir);
> -
> - return dentry;
> -
> -fail_dentry:
> - dput(dentry);
> -
> -fail_lock:
> - inode_unlock(dir);
> + goto fail;
> + return 0;
As KTR points out, this should be "return NULL;"
> +fail:
> simple_release_fs(&aafs_mnt, &aafs_count);
> -
> return ERR_PTR(error);
> }
>
> @@ -2572,8 +2559,7 @@ static int aa_mk_null_file(struct dentry *parent)
> if (error)
> return error;
>
> - inode_lock(d_inode(parent));
> - dentry = lookup_noperm(&QSTR(NULL_FILE_NAME), parent);
> + dentry = simple_start_creating(parent, NULL_FILE_NAME);
> if (IS_ERR(dentry)) {
> error = PTR_ERR(dentry);
> goto out;
> @@ -2581,7 +2567,7 @@ static int aa_mk_null_file(struct dentry *parent)
> inode = new_inode(parent->d_inode->i_sb);
> if (!inode) {
> error = -ENOMEM;
> - goto out1;
> + goto out;
> }
>
> inode->i_ino = get_next_ino();
> @@ -2593,18 +2579,12 @@ static int aa_mk_null_file(struct dentry *parent)
> aa_null.dentry = dget(dentry);
> aa_null.mnt = mntget(mount);
>
> - error = 0;
> -
> -out1:
> - dput(dentry);
> out:
> - inode_unlock(d_inode(parent));
> + simple_done_creating(dentry);
> simple_release_fs(&mount, &count);
> return error;
> }
>
> -
> -
> static const char *policy_get_link(struct dentry *dentry,
> struct inode *inode,
> struct delayed_call *done)
Assuming you fix the minor problem above.
Reviewed-by: Jeff Layton <[email protected]>
