Changes in Makefile

0fc8f6200d2313278fbf4539bbab74677c685531 - Merge drm/drm-fixes into drm-misc-fixes

Mon, 27 Apr 2026 10:26:49 +0200

Merge drm/drm-fixes into drm-misc-fixesGetting fixes and updates from v7.1-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/tools/testing/selftests/pidfd/Makefile

07c3ef58223e2c75ea209d8c416b976ec30d9413 - Merge tag 'vfs-7.1-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Mon, 13 Apr 2026 22:27:11 +0200

Merge tag 'vfs-7.1-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull clone and pidfs updates from Christian Brauner: "Add three new clone3() flags for pidfd-based process lifecycle management. CLONE_AUTOREAP: CLONE_AUTOREAP makes a child process auto-reap on exit without ever becoming a zombie. This is a per-process property in contrast to the existing auto-reap mechanism via SA_NOCLDWAIT or SIG_IGN for SIGCHLD which applies to all children of a given parent. Currently the only way to automatically reap children is to set SA_NOCLDWAIT or SIG_IGN on SIGCHLD. This is a parent-scoped property affecting all children which makes it unsuitable for libraries or applications that need selective auto-reaping of specific children while still being able to wait() on others. CLONE_AUTOREAP stores an autoreap flag in the child's signal_struct. When the child exits do_notify_parent() checks this flag and causes exit_notify() to transition the task directly to EXIT_DEAD. Since the flag lives on the child it survives reparenting: if the original parent exits and the child is reparented to a subreaper or init the child still auto-reaps when it eventually exits. This is cleaner than forcing the subreaper to get SIGCHLD and then reaping it. If the parent doesn't care the subreaper won't care. If there's a subreaper that would care it would be easy enough to add a prctl() that either just turns back on SIGCHLD and turns off auto-reaping or a prctl() that just notifies the subreaper whenever a child is reparented to it. CLONE_AUTOREAP can be combined with CLONE_PIDFD to allow the parent to monitor the child's exit via poll() and retrieve exit status via PIDFD_GET_INFO. Without CLONE_PIDFD it provides a fire-and-forget pattern. No exit signal is delivered so exit_signal must be zero. CLONE_THREAD and CLONE_PARENT are rejected: CLONE_THREAD because autoreap is a process-level property, and CLONE_PARENT because an autoreap child reparented via CLONE_PARENT could become an invisible zombie under a parent that never calls wait(). The flag is not inherited by the autoreap process's own children. Each child that should be autoreaped must be explicitly created with CLONE_AUTOREAP. CLONE_NNP: CLONE_NNP sets no_new_privs on the child at clone time. Unlike prctl(PR_SET_NO_NEW_PRIVS) which a process sets on itself, CLONE_NNP allows the parent to impose no_new_privs on the child at creation without affecting the parent's own privileges. CLONE_THREAD is rejected because threads share credentials. CLONE_NNP is useful on its own for any spawn-and-sandbox pattern but was specifically introduced to enable unprivileged usage of CLONE_PIDFD_AUTOKILL. CLONE_PIDFD_AUTOKILL: This flag ties a child's lifetime to the pidfd returned from clone3(). When the last reference to the struct file created by clone3() is closed the kernel sends SIGKILL to the child. A pidfd obtained via pidfd_open() for the same process does not keep the child alive and does not trigger autokill - only the specific struct file from clone3() has this property. This is useful for container runtimes, service managers, and sandboxed subprocess execution - any scenario where the child must die if the parent crashes or abandons the pidfd or just wants a throwaway helper process. CLONE_PIDFD_AUTOKILL requires both CLONE_PIDFD and CLONE_AUTOREAP. It requires CLONE_PIDFD because the whole point is tying the child's lifetime to the pidfd. It requires CLONE_AUTOREAP because a killed child with no one to reap it would become a zombie - the primary use case is the parent crashing or abandoning the pidfd so no one is around to call waitpid(). CLONE_THREAD is rejected because autokill targets a process not a thread. If CLONE_NNP is specified together with CLONE_PIDFD_AUTOKILL an unprivileged user may spawn a process that is autokilled. The child cannot escalate privileges via setuid/setgid exec after being spawned. If CLONE_PIDFD_AUTOKILL is specified without CLONE_NNP the caller must have have CAP_SYS_ADMIN in its user namespace"* tag 'vfs-7.1-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests: check pidfd_info->coredump_code correctness pidfds: add coredump_code field to pidfd_info kselftest/coredump: reintroduce null pointer dereference selftests/pidfd: add CLONE_PIDFD_AUTOKILL tests selftests/pidfd: add CLONE_NNP tests selftests/pidfd: add CLONE_AUTOREAP tests pidfd: add CLONE_PIDFD_AUTOKILL clone: add CLONE_NNP clone: add CLONE_AUTOREAP List of files: /linux/tools/testing/selftests/pidfd/Makefile

a2900f5aa4e7724a2bf56ddb1a4f816d4fcc0598 - Merge patch series "pidfd: add CLONE_AUTOREAP, CLONE_NNP, and CLONE_PIDFD_AUTOKILL"

Wed, 11 Mar 2026 23:24:31 +0100

Merge patch series "pidfd: add CLONE_AUTOREAP, CLONE_NNP, and CLONE_PIDFD_AUTOKILL"Christian Brauner says:Add three new clone3() flags for pidfd-based process lifecyclemanagement.=== CLONE_AUTOREAP ===CLONE_AUTOREAP makes a child process auto-reap on exit without everbecoming a zombie. This is a per-process property in contrast to theexisting auto-reap mechanism via SA_NOCLDWAIT or SIG_IGN for SIGCHLDwhich applies to all children of a given parent.Currently the only way to automatically reap children is to setSA_NOCLDWAIT or SIG_IGN on SIGCHLD. This is a parent-scoped propertyaffecting all children which makes it unsuitable for libraries orapplications that need selective auto-reaping of specific children whilestill being able to wait() on others.CLONE_AUTOREAP stores an autoreap flag in the child's signal_struct.When the child exits do_notify_parent() checks this flag and causesexit_notify() to transition the task directly to EXIT_DEAD. Since theflag lives on the child it survives reparenting: if the original parentexits and the child is reparented to a subreaper or init the child stillauto-reaps when it eventually exits. This is cleaner than forcing thesubreaper to get SIGCHLD and then reaping it. If the parent doesn't carethe subreaper won't care. If there's a subreaper that would care itwould be easy enough to add a prctl() that either just turns back onSIGCHLD and turns off auto-reaping or a prctl() that just notifies thesubreaper whenever a child is reparented to it.CLONE_AUTOREAP can be combined with CLONE_PIDFD to allow the parent tomonitor the child's exit via poll() and retrieve exit status viaPIDFD_GET_INFO. Without CLONE_PIDFD it provides a fire-and-forgetpattern. No exit signal is delivered so exit_signal must be zero.CLONE_THREAD and CLONE_PARENT are rejected: CLONE_THREAD becauseautoreap is a process-level property, and CLONE_PARENT because anautoreap child reparented via CLONE_PARENT could become an invisiblezombie under a parent that never calls wait().The flag is not inherited by the autoreap process's own children. Eachchild that should be autoreaped must be explicitly created withCLONE_AUTOREAP.=== CLONE_NNP ===CLONE_NNP sets no_new_privs on the child at clone time. Unlikeprctl(PR_SET_NO_NEW_PRIVS) which a process sets on itself, CLONE_NNPallows the parent to impose no_new_privs on the child at creationwithout affecting the parent's own privileges. CLONE_THREAD is rejectedbecause threads share credentials. CLONE_NNP is useful on its own forany spawn-and-sandbox pattern but was specifically introduced to enableunprivileged usage of CLONE_PIDFD_AUTOKILL.=== CLONE_PIDFD_AUTOKILL ===This flag ties a child's lifetime to the pidfd returned from clone3().When the last reference to the struct file created by clone3() is closedthe kernel sends SIGKILL to the child. A pidfd obtained via pidfd_open()for the same process does not keep the child alive and does not triggerautokill - only the specific struct file from clone3() has thisproperty. This is useful for container runtimes, service managers, andsandboxed subprocess execution - any scenario where the child must dieif the parent crashes or abandons the pidfd or just wants a throwawayhelper process.CLONE_PIDFD_AUTOKILL requires both CLONE_PIDFD and CLONE_AUTOREAP. Itrequires CLONE_PIDFD because the whole point is tying the child'slifetime to the pidfd. It requires CLONE_AUTOREAP because a killed childwith no one to reap it would become a zombie - the primary use case isthe parent crashing or abandoning the pidfd so no one is around to callwaitpid(). CLONE_THREAD is rejected because autokill targets a processnot a thread.If CLONE_NNP is specified together with CLONE_PIDFD_AUTOKILL anunprivileged user may spawn a process that is autokilled. The childcannot escalate privileges via setuid/setgid exec after being spawned.If CLONE_PIDFD_AUTOKILL is specified without CLONE_NNP the caller musthave have CAP_SYS_ADMIN in its user namespace.* patches from https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-0-d148b984a989@kernel.org: selftests/pidfd: add CLONE_PIDFD_AUTOKILL tests selftests/pidfd: add CLONE_NNP tests selftests/pidfd: add CLONE_AUTOREAP tests pidfd: add CLONE_PIDFD_AUTOKILL clone: add CLONE_NNP clone: add CLONE_AUTOREAPLink: https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-0-d148b984a989@kernel.orgSigned-off-by: Christian Brauner List of files: /linux/tools/testing/selftests/pidfd/Makefile

76d46ad2c52a4d7631274a35777ac4601103e2aa - selftests/pidfd: add CLONE_AUTOREAP tests

Thu, 26 Feb 2026 14:51:02 +0100

selftests/pidfd: add CLONE_AUTOREAP testsAdd tests for the new CLONE_AUTOREAP clone3() flag:- autoreap_without_pidfd: CLONE_AUTOREAP without CLONE_PIDFD works (fire-and-forget)- autoreap_rejects_exit_signal: CLONE_AUTOREAP with non-zero exit_signal fails- autoreap_rejects_parent: CLONE_AUTOREAP with CLONE_PARENT fails- autoreap_rejects_thread: CLONE_AUTOREAP with CLONE_THREAD fails- autoreap_basic: child exits, pidfd poll works, PIDFD_GET_INFO returns correct exit code, waitpid() returns -ECHILD- autoreap_signaled: child killed by signal, exit info correct via pidfd- autoreap_reparent: autoreap grandchild reparented to subreaper still auto-reaps- autoreap_multithreaded: autoreap process with sub-threads auto-reaps after last thread exits- autoreap_no_inherit: grandchild forked without CLONE_AUTOREAP becomes a regular zombieLink: https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-4-d148b984a989@kernel.orgSigned-off-by: Christian Brauner List of files: /linux/tools/testing/selftests/pidfd/Makefile

cb9f145f638d7afa633632a9290d6ad06caeb8ee - Merge remote-tracking branch 'drm/drm-next' into msm-next-robclark

Sat, 01 Nov 2025 13:47:30 +0100

Merge remote-tracking branch 'drm/drm-next' into msm-next-robclarkBack-merge drm-next to get caught up.Signed-off-by: Rob Clark List of files: /linux/tools/testing/selftests/pidfd/Makefile

f088104d837a991c65e51fa30bb4196169b3244d - Merge drm/drm-next into drm-intel-gt-next

Tue, 16 Sep 2025 12:53:20 +0200

Merge drm/drm-next into drm-intel-gt-nextBackmerge in order to get the commit: 048832a3f400 ("drm/i915: Refactor shmem_pwrite() to use kiocb and write_iter")To drm-intel-gt-next as there are followup fixes to be applied.Signed-off-by: Joonas Lahtinen List of files: /linux/tools/testing/selftests/pidfd/Makefile

a53d0cf7f1cb3182ad533ff5cacfa5fd29c419ad - Merge commit 'linus' into core/bugs, to resolve conflicts

Tue, 05 Aug 2025 11:15:34 +0200

Merge commit 'linus' into core/bugs, to resolve conflictsResolve conflicts with this commit that was developed in parallelduring the merge window: 8c8efa93db68 ("x86/bug: Add ARCH_WARN_ASM macro for BUG/WARN asm code sharing with Rust") Conflicts: arch/riscv/include/asm/bug.h arch/x86/include/asm/bug.hSigned-off-by: Ingo Molnar List of files: /linux/tools/testing/selftests/pidfd/Makefile

8b87f67b4c87452e21721887fa8dec1f4c6b2b7c - Merge branch 'next' into for-linus

Wed, 08 Oct 2025 06:53:13 +0200

Merge branch 'next' into for-linusPrepare input updates for 6.18 merge window. List of files: /linux/tools/testing/selftests/pidfd/Makefile

4b051897df2375414587a245ecb9bb1a4d26b3b8 - Merge tag 'v6.17-rc2' into HEAD

Thu, 21 Aug 2025 20:46:49 +0200

Merge tag 'v6.17-rc2' into HEADSync up with mainline to bring in changes to include/linux/sprintf.h List of files: /linux/tools/testing/selftests/pidfd/Makefile

b4d90dbc4c1bc4bd3eb2d2989330af0eb95c98e8 - Merge drm/drm-next into drm-misc-next-fixes

Mon, 15 Sep 2025 10:23:28 +0200

Merge drm/drm-next into drm-misc-next-fixesBackmerging to drm-misc-next-fixes to get features and fixes fromv6.17-rc6.Signed-off-by: Thomas Zimmermann List of files: /linux/tools/testing/selftests/pidfd/Makefile

702fdf3513b045f596f836d9a4b8672c76f11834 - Merge drm/drm-next into drm-intel-next

Wed, 10 Sep 2025 14:01:42 +0200

Merge drm/drm-next into drm-intel-nextCatching up with some display dependencies.Signed-off-by: Rodrigo Vivi List of files: /linux/tools/testing/selftests/pidfd/Makefile

ca994e8922f25f7fed2075098f185cf198109eaa - Merge drm/drm-next into drm-xe-next

Tue, 12 Aug 2025 14:58:37 +0200

Merge drm/drm-next into drm-xe-nextBring v6.17-rc1 to propagate commits from other subsystems, particularlyPCI, which has some new functions needed for SR-IOV integration.Signed-off-by: Lucas De Marchi List of files: /linux/tools/testing/selftests/pidfd/Makefile

08c51f5bddc81c8c97c1eb11861b0dc009e5ccd8 - Merge drm/drm-next into drm-misc-n

Mon, 11 Aug 2025 14:37:45 +0200

Merge drm/drm-next into drm-misc-nUpdating drm-misc-next to the state of v6.17-rc1. Begins a new releasecycle.Signed-off-by: Thomas Zimmermann List of files: /linux/tools/testing/selftests/pidfd/Makefile

8d2b0853add1d7534dc0794e3c8e0b9e8c4ec640 - Merge drm/drm-fixes into drm-misc-fixes

Mon, 11 Aug 2025 16:49:06 +0200

Merge drm/drm-fixes into drm-misc-fixesUpdating drm-misc-fixes to the state of v6.17-rc1. Begins a new releasecycle.Signed-off-by: Thomas Zimmermann List of files: /linux/tools/testing/selftests/pidfd/Makefile

bbfd5594756011167b8f8de9a00e0c946afda1e6 - Merge drm/drm-next into drm-intel-gt-next

Wed, 28 May 2025 09:20:17 +0200

Merge drm/drm-next into drm-intel-gt-nextNeed to pull in a67221b5eb8d ("drm/i915/dp: Return min bpc supported by source instead of 0")in order to fix build breakage on GCC 9.4.0 (from Ubuntu 20.04).Signed-off-by: Joonas Lahtinen List of files: /linux/tools/testing/selftests/pidfd/Makefile

db5302ae571beec635c1a96e7f72926a4e65195e - Merge drm/drm-next into drm-intel-next

Fri, 16 May 2025 09:22:36 +0200

Merge drm/drm-next into drm-intel-nextBackmerge to sync with v6.15-rc, xe, and specifically async flip changesin drm-misc.Signed-off-by: Jani Nikula List of files: /linux/tools/testing/selftests/pidfd/Makefile

672dcda246071e1940eab8bb5a03d04ea026f46e - Merge tag 'vfs-6.17-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Mon, 28 Jul 2025 23:10:15 +0200

Merge tag 'vfs-6.17-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull pidfs updates from Christian Brauner: - persistent info Persist exit and coredump information independent of whether anyone currently holds a pidfd for the struct pid. The current scheme allocated pidfs dentries on-demand repeatedly. This scheme is reaching it's limits as it makes it impossible to pin information that needs to be available after the task has exited or coredumped and that should not be lost simply because the pidfd got closed temporarily. The next opener should still see the stashed information. This is also a prerequisite for supporting extended attributes on pidfds to allow attaching meta information to them. If someone opens a pidfd for a struct pid a pidfs dentry is allocated and stashed in pid->stashed. Once the last pidfd for the struct pid is closed the pidfs dentry is released and removed from pid->stashed. So if 10 callers create a pidfs dentry for the same struct pid sequentially, i.e., each closing the pidfd before the other creates a new one then a new pidfs dentry is allocated every time. Because multiple tasks acquiring and releasing a pidfd for the same struct pid can race with each another a task may still find a valid pidfs entry from the previous task in pid->stashed and reuse it. Or it might find a dead dentry in there and fail to reuse it and so stashes a new pidfs dentry. Multiple tasks may race to stash a new pidfs dentry but only one will succeed, the other ones will put their dentry. The current scheme aims to ensure that a pidfs dentry for a struct pid can only be created if the task is still alive or if a pidfs dentry already existed before the task was reaped and so exit information has been was stashed in the pidfs inode. That's great except that it's buggy. If a pidfs dentry is stashed in pid->stashed after pidfs_exit() but before __unhash_process() is called we will return a pidfd for a reaped task without exit information being available. The pidfds_pid_valid() check does not guard against this race as it doens't sync at all with pidfs_exit(). The pid_has_task() check might be successful simply because we're before __unhash_process() but after pidfs_exit(). Introduce a new scheme where the lifetime of information associated with a pidfs entry (coredump and exit information) isn't bound to the lifetime of the pidfs inode but the struct pid itself. The first time a pidfs dentry is allocated for a struct pid a struct pidfs_attr will be allocated which will be used to store exit and coredump information. If all pidfs for the pidfs dentry are closed the dentry and inode can be cleaned up but the struct pidfs_attr will stick until the struct pid itself is freed. This will ensure minimal memory usage while persisting relevant information. The new scheme has various advantages. First, it allows to close the race where we end up handing out a pidfd for a reaped task for which no exit information is available. Second, it minimizes memory usage. Third, it allows to remove complex lifetime tracking via dentries when registering a struct pid with pidfs. There's no need to get or put a reference. Instead, the lifetime of exit and coredump information associated with a struct pid is bound to the lifetime of struct pid itself. - extended attributes Now that we have a way to persist information for pidfs dentries we can start supporting extended attributes on pidfds. This will allow userspace to attach meta information to tasks. One natural extension would be to introduce a custom pidfs.* extended attribute space and allow for the inheritance of extended attributes across fork() and exec(). The first simple scheme will allow privileged userspace to set trusted extended attributes on pidfs inodes. - Allow autonomous pidfs file handles Various filesystems such as pidfs and drm support opening file handles without having to require a file descriptor to identify the filesystem. The filesystem are global single instances and can be trivially identified solely on the information encoded in the file handle. This makes it possible to not have to keep or acquire a sentinal file descriptor just to pass it to open_by_handle_at() to identify the filesystem. That's especially useful when such sentinel file descriptor cannot or should not be acquired. For pidfs this means a file handle can function as full replacement for storing a pid in a file. Instead a file handle can be stored and reopened purely based on the file handle. Such autonomous file handles can be opened with or without specifying a a file descriptor. If no proper file descriptor is used the FD_PIDFS_ROOT sentinel must be passed. This allows us to define further special negative fd sentinels in the future. Userspace can trivially test for support by trying to open the file handle with an invalid file descriptor. - Allow pidfds for reaped tasks with SCM_PIDFD messages This is a logical continuation of the earlier work to create pidfds for reaped tasks through the SO_PEERPIDFD socket option merged in 923ea4d4482b ("Merge patch series "net, pidfs: enable handing out pidfds for reaped sk->sk_peer_pid""). - Two minor fixes: * Fold fs_struct->{lock,seq} into a seqlock * Don't bother with path_{get,put}() in unix_open_file()* tag 'vfs-6.17-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (37 commits) don't bother with path_get()/path_put() in unix_open_file() fold fs_struct->{lock,seq} into a seqlock selftests: net: extend SCM_PIDFD test to cover stale pidfds af_unix: enable handing out pidfds for reaped tasks in SCM_PIDFD af_unix: stash pidfs dentry when needed af_unix/scm: fix whitespace errors af_unix: introduce and use scm_replace_pid() helper af_unix: introduce unix_skb_to_scm helper af_unix: rework unix_maybe_add_creds() to allow sleep selftests/pidfd: decode pidfd file handles withou having to specify an fd fhandle, pidfs: support open_by_handle_at() purely based on file handle uapi/fcntl: add FD_PIDFS_ROOT uapi/fcntl: add FD_INVALID fcntl/pidfd: redefine PIDFD_SELF_THREAD_GROUP uapi/fcntl: mark range as reserved fhandle: reflow get_path_anchor() pidfs: add pidfs_root_path() helper fhandle: rename to get_path_anchor() fhandle: hoist copy_from_user() above get_path_from_fd() fhandle: raise FILEID_IS_DIR in handle_type ... List of files: /linux/tools/testing/selftests/pidfd/Makefile

867673063e1da91cf960133f25d87e38fc790d7b - Merge patch series "fhandle, pidfs: allow open_by_handle_at() purely based on file handle"

Tue, 24 Jun 2025 13:00:16 +0200

Merge patch series "fhandle, pidfs: allow open_by_handle_at() purely based on file handle"Christian Brauner says:Various filesystems such as pidfs and drm support opening file handleswithout having to require a file descriptor to identify the filesystem.The filesystem are global single instances and can be triviallyidentified solely on the information encoded in the file handle.This makes it possible to not have to keep or acquire a sentinal filedescriptor just to pass it to open_by_handle_at() to identify thefilesystem. That's especially useful when such sentinel file descriptorcannot or should not be acquired.For pidfs this means a file handle can function as full replacement forstoring a pid in a file. Instead a file handle can be stored andreopened purely based on the file handle.Such autonomous file handles can be opened with or without specifying aa file descriptor. If no proper file descriptor is used theFD_PIDFS_ROOT sentinel must be passed. This allows us to define furtherspecial negative fd sentinels in the future.Userspace can trivially test for support by trying to open the filehandle with an invalid file descriptor.* patches from https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-0-d02a04858fe3@kernel.org: selftests/pidfd: decode pidfd file handles withou having to specify an fd fhandle, pidfs: support open_by_handle_at() purely based on file handle uapi/fcntl: add FD_PIDFS_ROOT uapi/fcntl: add FD_INVALID uapi/fcntl: mark range as reserved fhandle: reflow get_path_anchor() pidfs: add pidfs_root_path() helper fhandle: rename to get_path_anchor() fhandle: hoist copy_from_user() above get_path_from_fd() fhandle: raise FILEID_IS_DIR in handle_typeLink: https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-0-d02a04858fe3@kernel.orgSigned-off-by: Christian Brauner List of files: /linux/tools/testing/selftests/pidfd/Makefile

914e6b1e85c5715ca2e7ec6293c05c71e9a98e86 - selftests/pidfd: decode pidfd file handles withou having to specify an fd

Tue, 24 Jun 2025 10:29:14 +0200

selftests/pidfd: decode pidfd file handles withou having to specify an fdLink: https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-11-d02a04858fe3@kernel.orgReviewed-by: Jan Kara Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner List of files: /linux/tools/testing/selftests/pidfd/Makefile

4e3d1e6e1b2d9df9650be14380c534b3c5081ddd - Merge patch series "pidfs: persistent info & xattrs"

Thu, 19 Jun 2025 14:28:31 +0200

Merge patch series "pidfs: persistent info & xattrs"Christian Brauner says:Persist exit and coredump information independent of whether anyonecurrently holds a pidfd for the struct pid.The current scheme allocated pidfs dentries on-demand repeatedly.This scheme is reaching it's limits as it makes it impossible to pininformation that needs to be available after the task has exited orcoredumped and that should not be lost simply because the pidfd gotclosed temporarily. The next opener should still see the stashedinformation.This is also a prerequisite for supporting extended attributes onpidfds to allow attaching meta information to them.If someone opens a pidfd for a struct pid a pidfs dentry is allocatedand stashed in pid->stashed. Once the last pidfd for the struct pid isclosed the pidfs dentry is released and removed from pid->stashed.So if 10 callers create a pidfs dentry for the same struct pidsequentially, i.e., each closing the pidfd before the other creates anew one then a new pidfs dentry is allocated every time.Because multiple tasks acquiring and releasing a pidfd for the samestruct pid can race with each another a task may still find a validpidfs entry from the previous task in pid->stashed and reuse it. Or itmight find a dead dentry in there and fail to reuse it and so stashes anew pidfs dentry. Multiple tasks may race to stash a new pidfs dentrybut only one will succeed, the other ones will put their dentry.The current scheme aims to ensure that a pidfs dentry for a struct pidcan only be created if the task is still alive or if a pidfs dentryalready existed before the task was reaped and so exit information hasbeen was stashed in the pidfs inode.That's great except that it's buggy. If a pidfs dentry is stashed inpid->stashed after pidfs_exit() but before __unhash_process() is calledwe will return a pidfd for a reaped task without exit information beingavailable.The pidfds_pid_valid() check does not guard against this race as itdoens't sync at all with pidfs_exit(). The pid_has_task() check might besuccessful simply because we're before __unhash_process() but afterpidfs_exit().Introduce a new scheme where the lifetime of information associated witha pidfs entry (coredump and exit information) isn't bound to thelifetime of the pidfs inode but the struct pid itself.The first time a pidfs dentry is allocated for a struct pid a structpidfs_attr will be allocated which will be used to store exit andcoredump information.If all pidfs for the pidfs dentry are closed the dentry and inode can becleaned up but the struct pidfs_attr will stick until the struct piditself is freed. This will ensure minimal memory usage while persistingrelevant information.The new scheme has various advantages. First, it allows to close therace where we end up handing out a pidfd for a reaped task for which noexit information is available. Second, it minimizes memory usage.Third, it allows to remove complex lifetime tracking via dentries whenregistering a struct pid with pidfs. There's no need to get or put areference. Instead, the lifetime of exit and coredump informationassociated with a struct pid is bound to the lifetime of struct piditself.Now that we have a way to persist information for pidfs dentries we canstart supporting extended attributes on pidfds. This will allowuserspace to attach meta information to tasks.One natural extension would be to introduce a custom pidfs.* extendedattribute space and allow for the inheritance of extended attributesacross fork() and exec().The first simple scheme will allow privileged userspace to set trustedextended attributes on pidfs inodes.* patches from https://lore.kernel.org/20250618-work-pidfs-persistent-v2-0-98f3456fd552@kernel.org: pidfs: add some CONFIG_DEBUG_VFS asserts selftests/pidfd: test setattr support selftests/pidfd: test extended attribute support selftests/pidfd: test extended attribute support pidfs: support xattrs on pidfds pidfs: make inodes mutable libfs: prepare to allow for non-immutable pidfd inodes pidfs: remove pidfs_pid_valid() pidfs: remove pidfs_{get,put}_pid() pidfs: remove custom inode allocation pidfs: remove unused members from struct pidfs_inode pidfs: persist information pidfs: move to anonymous struct libfs: massage path_from_stashed() libfs: massage path_from_stashed() to allow custom stashing behavior pidfs: raise SB_I_NODEV and SB_I_NOEXECLink: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-0-98f3456fd552@kernel.orgSigned-off-by: Christian Brauner List of files: /linux/tools/testing/selftests/pidfd/Makefile