nvmet_ns_enable_store() runs as a configfs store callback while configfs holds the item frag_sem. File-backed namespace enable used filp_open() on the configured device_path, so a path into configfs could re-enter __configfs_open_file() and try to acquire the same semaphore again. Use configfs_file_open() so the path is resolved before opening, configfs-backed paths are rejected, and the resolved path is opened with file_open_root() while retaining the normal open-time permission and security checks. Fixes: d5eff33ee6f8 ("nvmet: add simple file backed ns support") Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Assisted-by: LLM Codex Signed-off-by: Runyu Xiao --- drivers/nvme/target/io-cmd-file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c index 0b22d183f9279..2a4f25de94ba1 100644 --- a/drivers/nvme/target/io-cmd-file.c +++ b/drivers/nvme/target/io-cmd-file.c @@ -8,6 +8,7 @@ #include #include #include +#include #include #include "nvmet.h" @@ -38,7 +39,7 @@ int nvmet_file_ns_enable(struct nvmet_ns *ns) if (!ns->buffered_io) flags |= O_DIRECT; - ns->file = filp_open(ns->device_path, flags, 0); + ns->file = configfs_file_open(ns->device_path, flags, 0); if (IS_ERR(ns->file)) { ret = PTR_ERR(ns->file); pr_err("failed to open file %s: (%d)\n", -- 2.34.1