Kernel RFC moves procfs to kernfs-style I/O buffering

Christian Brauner has posted an RFC patch series that reworks how the Linux proc filesystem handles reads, writes, and ioctls, aligning it with the buffering model kernfs already uses. The goal is to end a long-standing class of stalls and related races when removable /proc entries are torn down.

Today, removing a proc entry waits for every in-flight operation on that entry to finish. Those operations often copy data to or from userspace while the entry stays pinned. A reader or writer can stretch that copy indefinitely with page faults, userfaultfd, or an unresponsive FUSE mount in a user namespace. Callers of the removal path frequently hold important locks across that wait.

The practical fallout is severe on the networking side. Every IPv6 network device exposes a snmp6 proc entry that ordinary users can read, and address configuration removes it while holding the RTNL lock. A stalled local reader can therefore hold RTNL for as long as the fault lasts, blocking device registration, removal, and rename, and blocking network namespace creation and teardown. Similar lock-holding patterns appear elsewhere, including shared mutexes used by hashlimit.

Brauner's approach is a broader fix than earlier narrow workarounds that layered extra buffering on seq_file. Removable entries would declare buffered read, write, and ioctl methods. Procfs itself copies arguments and results around the pin window, so entry code runs only while the entry is pinned and never touches userspace memory directly. Permanent entries such as kcore and kmsg may still read straight into userspace; the series refuses to register a removable entry that tries to do the same.

The RFC also lands conversion work across architecture, driver, filesystem, mm, and networking proc entries, plus selftests that exercise slow readers against module unload. A related sunrpc fix, reported by Chris Mason, restores a static wait queue for cache channel poll waiters after a use-after-free when a network namespace exited with pollers still queued. Chuck Lever has already acked parts of the conversion.

If accepted, the change would close an unprivileged local denial-of-service vector against core networking control paths and remove a family of removal-time stalls and use-after-free risks that seq_file-style direct userspace access made hard to eliminate piecemeal.