I was able to produce an oops by modifying the reproducer for bug #2 to create a fifo in the shiftfs filesystem and pass that in the fd field for the btrfs ioctl. Changing to check f_op.open does make sense to avoid this, though we must check for shiftfs_open and shiftfs_dir_open as allowed ioctls may also be valid for directories. Attaching an updated version of the second patch. With this I cannot reproduce the oops using a fifo.
I was able to produce an oops by modifying the reproducer for bug #2 to create a fifo in the shiftfs filesystem and pass that in the fd field for the btrfs ioctl. Changing to check f_op.open does make sense to avoid this, though we must check for shiftfs_open and shiftfs_dir_open as allowed ioctls may also be valid for directories. Attaching an updated version of the second patch. With this I cannot reproduce the oops using a fifo.