io: statx, fstatat64: allow using NULL as path

From: Miao Wang <shankerwangmiao@gmail.com>

Since linux 6.11, fstatat and statx syscalls allow using NULL as path
when AT_EMPTY_PATH is given. We also expose this to glibc users, and
change path to an empty string when this is not supported by the kernel.

Signed-off-by: Miao Wang <shankerwangmiao@gmail.com>
---
Since kernel 6.11, statx/fstatat(..., NULL, AT_EMPTH_PATH...) are
supported for better performance by avoiding copying buffer data from
userland. Since currently the declaration of statx and fstatat flags
the path argument as nonull, it prevents users from utilizing this
kernel feature. I can come up with the following possible solutions:

1. Directly remove the nonull annotation on the path argument, and
   pass the parameter given by the user as-is to the kernel, exposing
   the kernel behavior. This would be confusing since on older kernels,
   the user would receive EFAULT and need to handle this.

2. Based on 1, but if the user provides NULL, the handling of EFAULT is
   integrated in glibc, who implicitly change the parameter to an empty
   string if EFAULT received.

In either case, I think there is no need to introduce a new ABI version
of statx() and fstatat(), since we are loosening the restriction on the
given parameters, and executables linked with previous versions of statx
and fstatat can still work after this change.

This RFC patch contains changes for the solution 2 above.
---
 io/bits/statx-generic.h             |  2 +-
 io/sys/stat.h                       | 10 +++++-----
 io/tst-statx.c                      |  6 ++++++
 sysdeps/mach/hurd/fstatat64.c       |  2 ++
 sysdeps/unix/sysv/linux/fstatat64.c | 12 ++++++++++++
 sysdeps/unix/sysv/linux/statx.c     |  7 ++++++-
 6 files changed, 32 insertions(+), 7 deletions(-)


---
base-commit: 2eee835eca960c9d4119279804214b7a1ed5d156
change-id: 20240925-statx-null-path-user-c0c4ebbdf21c
prerequisite-change-id: 20240821-statx-null-path-531c0775bba4:v5
prerequisite-patch-id: cf313d4d0660fa972ce419167e3847722c3481d3

Best regards,

On Wed, 2024-09-25 at 00:37 +0800, Miao Wang via B4 Relay wrote:
> From: Miao Wang <shankerwangmiao@gmail.com>
> 
> Since linux 6.11, fstatat and statx syscalls allow using NULL as path
> when AT_EMPTY_PATH is given. We also expose this to glibc users, and
> change path to an empty string when this is not supported by the kernel.
> 
> Signed-off-by: Miao Wang <shankerwangmiao@gmail.com>
> ---
> Since kernel 6.11, statx/fstatat(..., NULL, AT_EMPTH_PATH...) are
> supported for better performance by avoiding copying buffer data from
> userland. Since currently the declaration of statx and fstatat flags
> the path argument as nonull, it prevents users from utilizing this
> kernel feature. I can come up with the following possible solutions:
> 
> 1. Directly remove the nonull annotation on the path argument, and
>    pass the parameter given by the user as-is to the kernel, exposing
>    the kernel behavior. This would be confusing since on older kernels,
>    the user would receive EFAULT and need to handle this.
> 
> 2. Based on 1, but if the user provides NULL, the handling of EFAULT is
>    integrated in glibc, who implicitly change the parameter to an empty
>    string if EFAULT received.
> 
> In either case, I think there is no need to introduce a new ABI version
> of statx() and fstatat(), since we are loosening the restriction on the
> given parameters, and executables linked with previous versions of statx
> and fstatat can still work after this change.
> 
> This RFC patch contains changes for the solution 2 above.

I'd suggest to separate this into two patches.  The first one drops the
__nonnull(...) on the path, the second one implements the fallback.  The
first patch would be so obvious to be applied then.

And I'm unsure if we should attempt to fix it up when the user is doing
something unsupported by the running kernel.  Are there some similar
cases in the past?

Also there's a difference between what this patch does and the actual
syscall interface of Linux >= 6.11: in Linux 6.11 fstatat(AT_FDCWD,
NULL, &stat, AT_EMPTY_PATH) still returns EFAULT (i.e. NULL can only be
used if AT_EMPTY_PATH **and** fd isn't AT_FDCWD), but this patch will
turn NULL into an empty string, making the case "supported."  I'll ask
the kernel dev to see if AT_FDCWD + NULL + AT_EMPTY_PATH case should be
supported.

> diff --git a/sysdeps/mach/hurd/fstatat64.c b/sysdeps/mach/hurd/fstatat64.c

I'm even more unsure if we should attempt to support it on a *completely
different* kernel.

/* snip */

> diff --git a/sysdeps/unix/sysv/linux/fstatat64.c b/sysdeps/unix/sysv/linux/fstatat64.c
> index 59b461cbcf..a9e3b85179 100644
> --- a/sysdeps/unix/sysv/linux/fstatat64.c
> +++ b/sysdeps/unix/sysv/linux/fstatat64.c
> @@ -156,6 +156,10 @@ __fstatat64_time64 (int fd, const char *file, struct __stat64_t64 *buf,
>  {
>    int r;
>  
> +#ifndef __ASSUME_STATX_NULL_PATH
> +retry:
> +#endif
> +
>  #if FSTATAT_USE_STATX
>    r = fstatat64_time64_statx (fd, file, buf, flag);
>  # ifndef __ASSUME_STATX
> @@ -166,6 +170,14 @@ __fstatat64_time64 (int fd, const char *file, struct __stat64_t64 *buf,
>    r = fstatat64_time64_stat (fd, file, buf, flag);
>  #endif
>  
> +#ifndef __ASSUME_STATX_NULL_PATH
> +  if (file == NULL && (flag & AT_EMPTY_PATH) && r == -EFAULT)
> +    {
> +      file = "";
> +      goto retry;

I'd just do

return __fstatat64_time64 (fd, "", buf, flag);

Because it's more readable, and any reasonable compiler should produce
the same result as the goto.

* Miao Wang via:

> From: Miao Wang <shankerwangmiao@gmail.com>
>
> Since linux 6.11, fstatat and statx syscalls allow using NULL as path
> when AT_EMPTY_PATH is given. We also expose this to glibc users, and
> change path to an empty string when this is not supported by the kernel.
>
> Signed-off-by: Miao Wang <shankerwangmiao@gmail.com>
> ---
> Since kernel 6.11, statx/fstatat(..., NULL, AT_EMPTH_PATH...) are
> supported for better performance by avoiding copying buffer data from
> userland. Since currently the declaration of statx and fstatat flags
> the path argument as nonull, it prevents users from utilizing this
> kernel feature. I can come up with the following possible solutions:
>
> 1. Directly remove the nonull annotation on the path argument, and
>    pass the parameter given by the user as-is to the kernel, exposing
>    the kernel behavior. This would be confusing since on older kernels,
>    the user would receive EFAULT and need to handle this.
>
> 2. Based on 1, but if the user provides NULL, the handling of EFAULT is
>    integrated in glibc, who implicitly change the parameter to an empty
>    string if EFAULT received.
>
> In either case, I think there is no need to introduce a new ABI version
> of statx() and fstatat(), since we are loosening the restriction on the
> given parameters, and executables linked with previous versions of statx
> and fstatat can still work after this change.

I'm not sure if we should change glibc to add this emulation.  It
prevents probing in the application to figure out if the kernel supports
the shortcut or not.  So it would keep hitting the double-system-call
case.

Thanks,
Florian