Re: [PATCH] fs: document semantics of kstat::{uid,gid} fields

On Wed, Aug 05, 2026 at 11:39:32AM +0200, Jan Kara wrote:
> On Mon 03-08-26 21:46:19, Jann Horn wrote:
> > The uid stored in struct kstat is logically a vfsuid; file systems
> > initialize it by converting a kuid (filesystem perspective) to a vfsuid
> > (mount perspective), then use vfsuid_into_kuid(), which essentially just
> > typecasts from vfsuid to kuid.
> > 
> > For now, just add a comment to note this mismatch between C type and
> > semantic type.
> > 
> > Below are some notes for anyone who wants to refactor this in the future.
> > 
> > There are probably two options to refactor this away:
> > 
> > 1. Change the type of kstat::uid to vfsuid_t, and perform the conversion
> >    from vfsuid to userspace-uid in the VFS layer. This wouldn't change
> >    machine code, just be more semantically correct.
> > 2. Change the semantics of kstat::uid to really be a kuid_t, and let the
> >    VFS layer take care of doing the translation from kuid to vfsuid that is
> >    currently done in filesystem code (or in generic_fillattr, on behalf of
> >    the filesystem code).
> > 
> > Option 2 is probably neater since it moves more logic into the generic VFS
> > layer, and this is something that is expected to work the same way in all
> > file systems?
> > 
> > The following coccinelle script:
> > ```
> > virtual context
> > 
> > @@
> > struct kstat *stat;
> > @@
> > * stat->uid
> > 
> > @@
> > struct kstat *stat;
> > @@
> > * stat->gid
> > 
> > @@
> > struct kstat stat;
> > @@
> > * stat.uid
> > 
> > @@
> > struct kstat stat;
> > @@
> > * stat.gid
> > ```
> > detects 43 field accesses to these uid/gid fields.
> > 
> > Signed-off-by: Jann Horn <[email protected]>
> 
> I don't remember the reason why things are like this - Christian will have
> to return from vacation for that :). But I agree with your analysis so feel
> free to add:

I already mentioned that to Jann somewhere else. The TL;DR is that the
correct way would be to add vfs{g,u}id_t everywhere so that translation
into vfs ownership happens at the disk <-> kernel and kernel <->
userspace boundaries only. But that's a massive patchset that I decided
against because the real win wasn't all that clear to me. I'm not saying
we shouldn't do it. Especially now with LLM help it is way less tedious
work but it'll be a big patch. :)