* [GIT PULL for v7.4] vfs fixes
@ 2026-11-11 22:36 Christian Brauner
2026-11-12 2:57 ` pr-tracker-bot
0 siblings, 1 reply; 6+ messages in thread
From: Christian Brauner @ 2026-11-11 22:36 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This contains another round of fixes for the current development cycle:
- inode: Let the shrinker reclaim inodes with I_METADATA_WRITEBACK like
any other clean inode and have evict() write out what the bit tracks
unless the inode is being deleted.
Since v7.3 ext2, ext4 without a journal, fat, udf and minix set
I_METADATA_WRITEBACK when they copy an inode into its buffer and only
fsync() and friends clear it again. inode_lru_isolate() took such
inodes off the LRU expecting something to put them back once the bit
was gone but nothing ever did. So they couldn't be reclaimed until
something fsynced them or the filesystem was unmounted. On ext4
without a journal an atime update was enough to pin an inode, and
creating 60000 small files in a memory cgroup limited to 96M got the
task OOM killed after about 43000 of them. Now all 60000 get created.
- dcache:
* Give d_set_mounted() a seqlock of its own that d_invalidate() waits
on after unhashing the dentry. Since v6.17 d_set_mounted() doesn't
bump the seqcount of rename_lock anymore, so a mount racing
d_invalidate() could end up below the unhashed directory. Nobody
can reach it there and it pins the subtree until the mount
namespace goes away. With a FUSE directory 3000 levels deep 151 of
200 bind mounts racing FUSE_NOTIFY_INVAL_ENTRY ended up there.
* Only take busy secondary roots off ->s_roots in do_one_tree() so
that umount waits for a racing eviction of an idle one. Since v7.3
it didn't, which ended in busy inodes after unmount and an iput()
on a dead superblock.
* Make a disconnected dentry a secondary root when the mount on it
goes away so that umount finds it and waits for its eviction. With
CAP_DAC_READ_SEARCH such a dentry can be mounted on via
open_by_handle_at() and move_mount() and umount racing its eviction
ended the same way.
- splice:
* Remove pipe buffer stealing as you and David suggested. fuse and
virtio_console were the only users of ->try_steal() and now always
copy, as they already did when a steal failed. Stealing took page
cache folios out of their files and turned pages into page cache
folios and back. SPLICE_F_GIFT and SPLICE_F_MOVE are still accepted
and fuse still advertises FUSE_SPLICE_MOVE so servers that ask for
it mount as before.
* Clamp a ->write_iter() result that is larger than the iterator in
iter_file_splice_write() instead of only warning about it.
Otherwise the pipe releases buffers past its head.
- ns:
* Allocate the namespace id before calling the namespace_init LSM hook
that was added this merge window. Landlock now logs the allocated id
instead of zero when it denies the creation of a namespace.
* Don't mark the arguments of the namespace_init and namespace_free
hooks as trusted for bpf LSM programs. Both see namespaces that are
only partially set up or on their way out.
- proc: Don't let proc_sys_call_handler() report more bytes written than
it was passed when a cgroup/sysctl bpf program replaced the value with
a longer one. A splice() into the sysctl file then walked past the
pipe head.
- coda: Pass the append state of each write on to the container file
with RWF_APPEND or RWF_NOAPPEND. coda_open() sets O_APPEND on the
container file after its iocb flags were cached, so an O_APPEND write
overwrote existing data instead of appending.
- adfs: Reject big directory entries in adfs_fplus_getnext() whose name
doesn't fit into the name buffer. A crafted image overflowed it on the
stack.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit 1448959fe3d013ffdb8302d17e4a8fdad2d2da95:
fs: fix the SEEK_CUR f_lock condition (2026-11-09 16:04:55 +0100)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc3.fixes.2
for you to fetch changes up to 2cca8a6f6ae690755862f5b633125119dcf6bd0c:
Merge patch series "ns: fixes identifier fixes" (2026-11-11 12:41:49 +0100)
----------------------------------------------------------------
vfs-7.4-rc3.fixes.2
Please consider pulling these changes from the signed vfs-7.4-rc3.fixes.2 tag.
Thanks!
Christian
----------------------------------------------------------------
Cheng Yongkang (2):
fs/proc: fix the write length returned by proc_sys_call_handler()
fs/splice: clamp an over-reported write_iter result
Christian Brauner (22):
ext2: add ext2_inode_block() helper
ext2: don't read the inode block in ext2_sync_inode_metadata()
ext4: use sb_find_get_block_nonatomic() in ext4_get_inode_loc_noio()
ext4: don't read the inode block in ext4_sync_inode_metadata()
minix: add minix_inode_block() helper
minix: don't read the inode block in minix_sync_inode_metadata()
udf: don't allocate the inode block in udf_sync_inode_metadata()
fs: set I_METADATA_WRITEBACK in mmb_mark_buffer_dirty()
fs: don't strand I_METADATA_WRITEBACK inodes outside the LRU
ext2: drop mmb_sync() from ext2_evict_inode()
ext4: drop mmb_sync() from ext4_evict_inode()
minix: drop mmb_sync() from minix_evict_inode()
udf: drop mmb_sync() from udf_evict_inode()
fat: drop mmb_sync() from fat_evict_inode()
Merge patch series "fs: reclaim inodes with I_METADATA_WRITEBACK"
dcache: let d_invalidate() wait for a d_set_mounted() in flight
Merge patch series "dcache: fixes for mountpoints racing d_invalidate() and umount"
Merge patch series "splice: remove pipe buffer stealing"
bpf: don't mark namespace_init and namespace_free arguments as trusted
ns: allocate the namespace id before the namespace_init hook
nstree: drop ns_tree_add_raw()
Merge patch series "ns: fixes identifier fixes"
Hungyu Lin (1):
coda: honor the append state of each write
HyeongJun An (1):
fs/adfs: bound directory entry name length in adfs_fplus_getnext()
Josef Bacik (2):
dcache: wait for a racing eviction of a secondary root
dcache: let umount find a disconnected ex-mountpoint
Kiryl Shutsemau (Meta) (4):
virtio_console: copy pipe buffers in splice_write()
fuse: don't move pipe buffers into the page cache
splice: remove pipe buffer stealing
splice: replace nosteal_pipe_buf_ops with default_pipe_buf_ops
Documentation/admin-guide/LSM/landlock.rst | 5 +-
Documentation/trace/events-landlock.rst | 5 +-
drivers/char/virtio_console.c | 39 +++-----
fs/adfs/dir_fplus.c | 2 +
fs/buffer.c | 16 +++-
fs/coda/file.c | 3 +-
fs/dcache.c | 44 +++++++--
fs/ext2/inode.c | 63 ++++++++-----
fs/ext4/inode.c | 22 ++---
fs/fat/inode.c | 1 -
fs/fuse/args.h | 1 -
fs/fuse/dev.c | 146 +----------------------------
fs/fuse/file.c | 1 -
fs/fuse/fuse_dev_i.h | 1 -
fs/inode.c | 13 ++-
fs/minix/bitmap.c | 37 +++++---
fs/minix/inode.c | 18 ++--
fs/minix/minix.h | 1 +
fs/namespace.c | 6 +-
fs/pipe.c | 43 ---------
fs/proc/proc_sysctl.c | 5 +-
fs/splice.c | 113 +++-------------------
fs/udf/inode.c | 33 +++----
include/linux/fs/super_types.h | 2 +-
include/linux/ns_common.h | 16 ++--
include/linux/nstree.h | 29 +-----
include/linux/pipe_fs_i.h | 38 --------
include/trace/events/landlock.h | 3 +-
ipc/namespace.c | 3 +-
kernel/bpf/bpf_lsm.c | 2 +
kernel/nscommon.c | 7 +-
kernel/nstree.c | 2 +-
kernel/watch_queue.c | 4 -
mm/shmem.c | 7 --
net/core/net_namespace.c | 4 +-
net/core/skbuff.c | 2 +-
security/landlock/ns.c | 3 +-
tools/testing/selftests/landlock/ns_test.c | 7 +-
38 files changed, 239 insertions(+), 508 deletions(-)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [GIT PULL for v7.4] vfs fixes
2026-11-11 22:36 [GIT PULL for v7.4] vfs fixes Christian Brauner
@ 2026-11-12 2:57 ` pr-tracker-bot
0 siblings, 0 replies; 6+ messages in thread
From: pr-tracker-bot @ 2026-11-12 2:57 UTC (permalink / raw)
To: Christian Brauner
Cc: Linus Torvalds, Christian Brauner, linux-fsdevel, linux-kernel
The pull request you sent on Wed, 11 Nov 2026 23:36:23 +0100:
> git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc3.fixes.2
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/9d66f26fefacebfeed15de31c1123451a17ff119
Thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [GIT PULL for v7.4] vfs fixes
2026-11-10 10:47 Christian Brauner
@ 2026-11-10 17:50 ` pr-tracker-bot
0 siblings, 0 replies; 6+ messages in thread
From: pr-tracker-bot @ 2026-11-10 17:50 UTC (permalink / raw)
To: Christian Brauner
Cc: Linus Torvalds, Christian Brauner, linux-fsdevel, linux-kernel
The pull request you sent on Tue, 10 Nov 2026 11:47:42 +0100:
> git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc3.fixes
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/5f5be6584cf5af0d70ee2fd40aa6264da18617ec
Thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* [GIT PULL for v7.4] vfs fixes
@ 2026-11-10 10:47 Christian Brauner
2026-11-10 17:50 ` pr-tracker-bot
0 siblings, 1 reply; 6+ messages in thread
From: Christian Brauner @ 2026-11-10 10:47 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
/* Summary */
This contains fixes for the current development cycle:
- libfs: Make readdir on tmpfs walk the offset tree in offset order
instead of d_children to avoid skipping entries or relisting the whole
directory.
It's faster too. Listing a million entries takes 114ms instead of
146ms, and 113ms instead of 470ms with four processes listing in
parallel.
- iomap: Finish the ->iomap_next() conversion that started in v7.3.
The nilfs2 and fuse ext_map iomap code added this merge window is
converted so now we can remove the ->iomap_begin()/->iomap_end()
fallback. We waited until the new iomap users from other trees were in
mainline otherwise this would have been very messy.
- errseq: Retry with the current value when the cmpxchg() in
errseq_check_and_advance() fails to avoid an old value coming back
later hiding the errors.
- aio: Hold an extra count for exit_aio() itself so it can't return
before the last free_ioctx_reqs() callback has called complete().
- pidfd: Fail the namespace ioctls with EREMOTE unless the target is
visible in the caller's pid namespace like PIDFD_GET_INFO does.
- eventpoll: Wake the next waiter when a woken waiter returns early
because of a fatal signal to avoid sleeping forever.
- backing-file: Pass RWF_NOAPPEND on to synchronous writes to the
backing file.
- initrd: Flush the deferred fput() of the ramdisk file before mounting
root.
- iov_iter: Take an unsigned long segment count in import_iovec(). The
upper 32 bits of the count passed to readv(), writev() and friends
were dropped before the UIO_MAXIOV check.
- splice: Advance the pipe tail before checking for a full bvec array
in splice_to_socket(). The last buffer was counted again, so MSG_MORE
was set although the pipe was empty and small TCP transfers waited
for the cork timeout.
- vfs:
* Reject negative offsets for SEEK_DATA and SEEK_HOLE in
default_llseek() and use must_set_pos() for its whence handling.
* Only clear tv_nsec in timestamp_truncate() when clamping changed
the seconds. Timestamps whose seconds were exactly at a filesystem
time limit lost their subsecond part.
* Don't leak the kernel-internal STATX_ATTR_CHANGE_MONOTONIC in
stx_attributes_mask.
* Clamp the FIONREAD result to the int range so a file with 4 GiB
left isn't reported as empty.
* Fix the SEEK_CUR f_lock check.
- selftests: Fix the statmount and mount_setattr tests on 32-bit and
s390, build the fchmodat2 and openat2 tests without sanitizers when
the toolchain lacks the runtimes and fix a clang warning in the
mount-notify test.
- docs: Fix a docutils warning in porting.rst.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit 05441d697f7f9a927264f4058cbbc6a03dfcac9d:
Merge tag 'cocci-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux (2026-11-03 08:36:32 -0800)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc3.fixes
for you to fetch changes up to 1448959fe3d013ffdb8302d17e4a8fdad2d2da95:
fs: fix the SEEK_CUR f_lock condition (2026-11-09 16:04:55 +0100)
----------------------------------------------------------------
vfs-7.4-rc3.fixes
Please consider pulling these changes from the signed vfs-7.4-rc3.fixes tag.
Thanks!
Christian
----------------------------------------------------------------
Abbott Liu (1):
initrd: flush deferred fput() before mounting root
Andrea Parri (1):
iov_iter: take an unsigned long segment count in import_iovec()
Avi Weiss (2):
fs: clamp FIONREAD result to int range
splice, net: avoid MSG_MORE when the bvec array fills
Chen Linxuan (1):
pidfd: restrict task access ioctls to the caller's pid namespace
Chris Mason (1):
backing-file: pass RWF_NOAPPEND to synchronous writes
Christian Brauner (9):
libfs: make i_rwsem the lock of the offset tree
libfs: walk offset directories in offset order
libfs: end offset readdir at positions past DIR_OFFSET_EOD
Merge patch series "libfs: fix readdir of offset directories"
Merge patch series "iomap: remaining patches for iomap_iter_next conversion"
Merge patch series "errseq: fix lost writeback errors in errseq_check_and_advance()"
Merge patch series "fs: fix and deduplicate whence handling in default_llseek()"
aio: don't let exit_aio() return before complete() is done
fs: fix the SEEK_CUR f_lock condition
Hungyu Lin (1):
vfs: preserve subsecond timestamps at filesystem time limits
Jeff Layton (1):
statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask
Joanne Koong (5):
nilfs2: convert iomap ops to ->iomap_next()
fuse: convert ext_map iomap ops to ->iomap_next()
iomap: remove ->iomap_begin()/->iomap_end() legacy path
iomap: pass iomap_iter_next_fn directly instead of struct iomap_ops
Documentation: iomap: update docs to reflect iomap_iter_next model
Mani Tofigh (1):
eventpoll: wake the next waiter when a woken waiter is killed
Randy Dunlap (1):
fs: porting.rst: use literal string to avoid warning
Sasha Levin (4):
selftests/statmount: fix format warnings on 32-bit and s390
selftests/mount_setattr: build with a 64-bit off_t
selftests: probe for sanitizer support in fchmodat2 and openat2
selftests/fs/mount-notify: fix the indentation in the fsmount test
Shashank Mohan Jain (2):
errseq: don't let errseq_check_and_advance() hide later errors
lib/tests: errseq: add a concurrent check_and_advance test
Siddharth Chintamaneni (2):
fs: reject negative offsets for SEEK_DATA and SEEK_HOLE in default_llseek()
fs: use must_set_pos() in default_llseek()
Documentation/filesystems/iomap/design.rst | 140 +++++++++++++++------
Documentation/filesystems/iomap/operations.rst | 68 +++++-----
Documentation/filesystems/iomap/porting.rst | 16 ++-
Documentation/filesystems/porting.rst | 2 +-
block/fops.c | 10 +-
fs/aio.c | 4 +-
fs/backing-file.c | 7 +-
fs/btrfs/direct-io.c | 8 +-
fs/dax.c | 48 +++----
fs/erofs/data.c | 28 ++---
fs/erofs/internal.h | 3 +-
fs/erofs/zmap.c | 7 +-
fs/eventpoll.c | 11 +-
fs/exfat/file.c | 14 +--
fs/exfat/inode.c | 6 +-
fs/exfat/iomap.c | 22 +---
fs/exfat/iomap.h | 6 +-
fs/ext2/ext2.h | 3 +-
fs/ext2/file.c | 4 +-
fs/ext2/inode.c | 9 +-
fs/ext4/ext4.h | 10 +-
fs/ext4/extents.c | 8 +-
fs/ext4/file.c | 22 ++--
fs/ext4/inode.c | 58 +++------
fs/f2fs/data.c | 6 +-
fs/f2fs/f2fs.h | 3 +-
fs/f2fs/file.c | 4 +-
fs/file.c | 10 +-
fs/fuse/dax.c | 10 +-
fs/fuse/ext_map.c | 11 +-
fs/fuse/file.c | 10 +-
fs/fuse/virtio_fs.c | 3 +-
fs/gfs2/aops.c | 6 +-
fs/gfs2/bmap.c | 9 +-
fs/gfs2/bmap.h | 2 +-
fs/gfs2/file.c | 6 +-
fs/gfs2/inode.c | 6 +-
fs/hpfs/file.c | 6 +-
fs/inode.c | 3 +-
fs/internal.h | 1 -
fs/ioctl.c | 5 +-
fs/iomap/buffered-io.c | 40 +++---
fs/iomap/direct-io.c | 8 +-
fs/iomap/fiemap.c | 8 +-
fs/iomap/iter.c | 13 +-
fs/iomap/seek.c | 8 +-
fs/iomap/swapfile.c | 4 +-
fs/iomap/trace.h | 12 +-
fs/libfs.c | 133 ++++++++------------
fs/nilfs2/file.c | 2 +-
fs/nilfs2/iomap.c | 4 +-
fs/nilfs2/iomap.h | 4 +-
fs/ntfs/aops.c | 6 +-
fs/ntfs/file.c | 20 +--
fs/ntfs/inode.c | 2 +-
fs/ntfs/iomap.c | 42 ++-----
fs/ntfs/iomap.h | 10 +-
fs/ntfs3/file.c | 16 +--
fs/ntfs3/inode.c | 13 +-
fs/ntfs3/ntfs_fs.h | 3 +-
fs/pidfs.c | 8 ++
fs/read_write.c | 48 +++----
fs/remap_range.c | 6 +-
fs/splice.c | 2 +-
fs/stat.c | 6 +-
fs/xfs/xfs_aops.c | 8 +-
fs/xfs/xfs_file.c | 53 ++++----
fs/xfs/xfs_iomap.c | 55 ++------
fs/xfs/xfs_iomap.h | 16 +--
fs/xfs/xfs_iops.c | 4 +-
fs/xfs/xfs_reflink.c | 6 +-
fs/zonefs/file.c | 22 ++--
include/linux/dax.h | 18 ++-
include/linux/fs.h | 9 +-
include/linux/iomap.h | 66 +++++-----
include/linux/stat.h | 3 +
include/linux/uio.h | 8 +-
init/do_mounts_rd.c | 5 +
lib/errseq.c | 29 +++--
lib/iov_iter.c | 6 +-
lib/tests/errseq_kunit.c | 110 +++++++++++++++-
mm/shmem.c | 2 +-
tools/testing/selftests/fchmodat2/Makefile | 18 ++-
.../filesystems/mount-notify/mount-notify_test.c | 8 +-
.../testing/selftests/filesystems/openat2/Makefile | 18 ++-
.../filesystems/statmount/statmount_test.c | 4 +-
.../filesystems/statmount/statmount_test_ns.c | 5 +-
tools/testing/selftests/mount_setattr/Makefile | 2 +-
88 files changed, 776 insertions(+), 732 deletions(-)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [GIT PULL for v7.4] vfs fixes
2026-10-30 17:20 Christian Brauner
@ 2026-10-30 23:10 ` pr-tracker-bot
0 siblings, 0 replies; 6+ messages in thread
From: pr-tracker-bot @ 2026-10-30 23:10 UTC (permalink / raw)
To: Christian Brauner
Cc: Linus Torvalds, Christian Brauner, linux-fsdevel, linux-kernel
The pull request you sent on Fri, 30 Oct 2026 18:20:21 +0100:
> git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.fixes
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/0c8bf38058e5ac0e42246acb13f623b7962a3922
Thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* [GIT PULL for v7.4] vfs fixes
@ 2026-10-30 17:20 Christian Brauner
2026-10-30 23:10 ` pr-tracker-bot
0 siblings, 1 reply; 6+ messages in thread
From: Christian Brauner @ 2026-10-30 17:20 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
As is the new normal, this is larger set of fixes for this cycle. I have
a bunch of fixes in the pipeline but no need to delay the current set
any longer than necessary.
/* Summary */
- writeback:
* Update dirtied_when instead of dirtied_time_when when a wb switch
puts an inode at the newest end of the target b_dirty list. The list
was left out of order so move_expired_inodes() could stop before
older inodes, and the lazytime expiration timestamp was reset.
* Clear the old wb's dirty-I/O state and bandwidth contribution when a
batch of inode switches leaves its dirty lists empty. An empty wb
stayed scheduled for periodic writeback and inflated
bdi->tot_write_bandwidth.
* Take wb_switch_rwsem across the inode scan of
cleanup_offline_cgwb(). The v7.3-rc5 fix that rotates scanned inodes
let a scan racing a sync()'s queue_io() move lazytime inodes past
the sync's cutoff, so sync() returned without persisting their
timestamps.
* Don't kick writeback for an IOCB_DONTCACHE write on an inode that
has no wb yet. With cgroup writeback an O_DIRECT RWF_DONTCACHE write
to a block device dereferenced NULL.
- statmount/listmount/listns:
* Refuse statmount() string requests with a buffer that isn't larger
than struct statmount.
* Don't wrap around with a U64_MAX cursor in listmount() and listns().
* Don't end listns() at an inactive namespace.
* Only add init_ipc_ns and init_net to the namespace trees if
CONFIG_IPC_NS and CONFIG_NET_NS are enabled.
- iomap:
* Only mark blocks uptodate in __iomap_write_begin() after reading
them and let __iomap_write_end() mark the zeroed blocks uptodate
once the copy from userspace succeeded.
* Check a chunk against max_integrity_io_size() on its own before the
bio size check.
* Only enforce block alignment for direct I/O into holes and
unwritten extents if IOMAP_DIO_FSBLOCK_ALIGNED is set.
- backing-file:
* Check S_APPEND and S_IMMUTABLE on the backing inode. FUSE
passthrough opens the backing file with vfs_open() which skips
may_open(), so anyone who may open the FUSE file for writing could
overwrite an append-only backing file anywhere or write to an
immutable one. Open, mmap and writes now check the backing inode
the way may_open() and do_mmap() do.
* Always call kiocb_end_write() for a queued write
* Let backing files inherit FMODE_NONOTIFY from the user file. The
event fds fanotify creates for permission events on a stacked
filesystem raised FS_OPEN_PERM on the real path from inside the
listener's read() and deadlocked listeners with marks on both
layers.
- pidfs:
* Look the task up before checking for exit information in
PIDFD_GET_INFO and start over if the task no longer owns the pid
once all fields have been read. A caller racing release_task() got
neither PIDFD_INFO_PID nor PIDFD_INFO_EXIT or ESRCH although the
exit information was available, and a caller racing a sub-thread's
exec reported that thread's tid as the pid.
* Clear the mask bits of fields that lie beyond the struct size the
caller passed. The uapi header promises that the mask names no such
field but a caller passing PIDFD_INFO_SIZE_VER0 got the coredump and
supported mask bits set for fields that were never written.
- aio:
* Give the aio ring a ->read_folio that fails with EIO so a fault on a
ring whose file was truncated gets SIGBUS instead of jumping to
NULL.
* Check nr_events against the ring size before doubling it in
ioctx_alloc().
- splice:
* Only write back an implicit file position in do_splice() when the
splice helper succeeded. splice doesn't take f_pos_lock so a failed
splice restored a stale snapshot over a position that a concurrent
getdents() had moved. On ext2 the next readdir then trusted an
offset inside a directory entry.
* Retry tee() when the input pipe was emptied or the output pipe
filled between the prep steps and link_pipe() instead of returning 0
while the input pipe still has writers, as splice_pipe_to_pipe()
does.
- ucount:
* Take the reference that pins a ucounts level on the 0 -> 1
transition before checking the rlimit.
* Read the parent ucounts before dropping the rlimit count in
do_dec_rlimit_put_ucounts().
- inode:
* Rotate inodes whose page cache couldn't be dropped to the tail of
the LRU.
* Skip inodes that another LRU walker is isolating.
- setns:
* Set nsset->flags before anything in prepare_nsset() can fail so the
error path drops the cred prepared for CLONE_NEWUSER. A failing
setns() with CLONE_NEWUSER and CLONE_NEWNS leaked it together with
its user namespace.
* Refuse setns(CLONE_NEWNS) for a task that shares its fs_struct again
when more namespaces are requested.
- minix:
* Restore uptodate on the pinned bitmap buffers before redirtying them
after a failed writeback instead of tripping the warning in
mark_buffer_dirty(), as ext2 and ext4 do for their superblock
buffers.
* Reject rmdir() of a directory with a corrupted link count with
EFSCORRUPTED instead of hitting the drop_nlink() warning.
- userns: Keep the exec securebits and their locks when creating or
joining a user namespace. set_cred_user_ns() reset all securebits to
SECUREBITS_DEFAULT so anyone who may create a user namespace could
shed SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE with a
single unshare(CLONE_NEWUSER).
- fs: Honor FOP_UNSIGNED_OFFSET in sys_llseek() and in the pread64(),
pwrite64(), preadv() and pwritev() wrappers.
- proc/kcore: Advance the vmalloc retry in read_kcore_iter() by the
last vread_iter() copy instead of the running total.
- eventpoll: Return the error when the wakeup source for EPOLLWAKEUP
can't be created in EPOLL_CTL_MOD instead of reporting success
without suspend protection.
- coredump: Mark do_coredump() noinline_for_stack.
- nsfs: Check the trailing bytes of a namespace file handle in bytes
instead of words.
- netfs: Restore the per-level and per-point decoding of the debug
mask.
- exportfs: Release the directory file get_name() opened with
__fput_sync(). From nfsd's kernel threads the deferred fputs arrived
faster than delayed_fput retired them and each pinned the directory's
readdir state, growing unreclaimable slab by about 90 MB per second
under a parallel tree walk.
- fs: Call ramfs_kill_sb() for a ramfs rootfs. Since rootfs can be
unmounted as of v7.0 its struct ramfs_fs_info was leaked.
- signal: Check the blocked mask for every entry
dequeue_synchronous_signal() looks at. The scan could select a blocked
synchronous signal and deliver it while blocked.
- super: Convert the superblock device table from an rhltable to a
plain hashtable under a spinlock. This fixes a bug from v7.3 where
fs_bdev_freeze() froze a btrfs filesystem through a stale member that
open_ctree() had already released while the freeze was waiting for SB_BORN.
- fork: Leave rcu_users at zero until copy_process() can't fail anymore.
bpf_task_acquire() handed out trusted references to the new task from
the task_alloc LSM hook and sched_ext's ops.init_task() and a failing
fork freed the task behind them.
- xattr: Always run cap_convert_nscap() for a security.capability write.
A zero-length setxattr() skipped it and let an unprivileged caller
without CAP_SETFCAP or write permission on the file plant an empty
security.capability xattr that made every execve() of the binary fail
with EINVAL.
- namei: Skip the S_ISDIR assertion in
- proc: Refuse to mount on entries below /proc/<pid>/net like fd/,
fdinfo/ and map_files/. proc_net_d_revalidate() always fails so the
first lookup by anyone with search permission ran d_invalidate() on
the dentry and detached every mount on it, locked mounts included.
- libfs: Hold one mount reference for all pins instead of one per pin.
The pin count is what keeps the mount alive, so the per-pin reference
only cost a mntget() and a mntput() through
mntput_no_expire_slowpath() for every debugfs, tracefs, securityfs or
configfs file that comes and goes.
- iov_iter: Return 0 from iov_iter_alignment() for an empty iterator of
any type.
- watch_queue: Give info_id its own storage instead of overlaying it
with rcu_head.
- filelock: Take an active superblock reference while waiting for a
delegation break. After a lazy umount closing the delegation holder
could shut down the superblock under the waiter whose final iput()
then ran shmem_evict_inode() on freed state.
- fs: Skip the copy_file_range() write limit checks when there is no
data to copy.
- bpf: Allow bpf_d_path() from fentry on filp_close_sync(). Since
close_range() became synchronous this cycle close(), close_range()
and the closes on exec and exit no longer go through filp_close().
fexit stays rejected since the file may be gone by then.
- fs_pin: Dequeue the wait entry unconditionally in pin_kill(). A
spuriously woken waiter kept its on-stack entry queued, took that as
proof that the pin was alive and used the freed acct structure when
umount() of the accounting file raced acct(2).
- dcache: Don't fail __d_obtain_alias() for an inode without links and
aliases. The ESTALE check added this cycle broke open_by_handle_at()
and nfsd file handle decoding on NFS and FUSE where i_nlink is just
what the server last reported and the handle may well still be valid.
- selftests/ovl: Fix the mountinfo expectations of the detached layer
test which has failed since it was added.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit 7be4bc52fd9e0e55dc9a2e0232b89427d2c4b614:
Merge tag 'driver-core-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core (2026-10-21 18:53:14 -1000)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.fixes
for you to fetch changes up to a522dd871024a0f065bfa7638afdb929607f58fc:
fs: don't fail __d_obtain_alias() for unlinked inodes (2026-10-30 17:18:39 +0100)
----------------------------------------------------------------
vfs-7.4-rc1.fixes
Please consider pulling these changes from the signed vfs-7.4-rc1.fixes tag.
Thanks!
Christian
----------------------------------------------------------------
Amir Goldstein (2):
selftests/ovl: fix detached layer mountinfo expectations
fs: don't fail __d_obtain_alias() for unlinked inodes
Arnd Bergmann (1):
coredump: reduce stack usage in vfs_coredump
Avi Weiss (1):
signal: skip blocked signals in dequeue_synchronous_signal()
Chris Mason (3):
aio: fix NULL deref when a fault races ring truncation
iov_iter: fix NULL deref in iov_iter_alignment()
backing-file: always end a queued write
Christian Brauner (23):
Merge patch series "writeback: fix timestamp and dirty-state handling in wb switches"
Merge patch series "fs: honor FOP_UNSIGNED_OFFSET in llseek and positional I/O"
selftests/filesystems: add a test for freezing a shared block device
super: convert to plain hashtable
Merge patch series "super: convert to a plain hashtable"
statmount: don't copy the reserved empty string past the buffer
selftests/filesystems: check short buffers for statmount() strings
listmount: don't wrap around with a U64_MAX cursor
selftests/filesystems: check listmount() with a U64_MAX cursor
listns: don't wrap around with a U64_MAX cursor
selftests/namespaces: check listns() with a U64_MAX cursor
Merge patch series "fs: fixes for statmount() short buffers and listmount()/listns() cursors"
iomap: don't mark unwritten parts of a folio uptodate
Merge patch series "iomap: fixes for short copies and integrity bio sizes"
userns: don't drop the exec securebits
selftests/exec: check that user namespaces keep the exec securebits
Merge patch series "userns: keep the exec securebits"
proc: don't let an entry below /proc/<pid>/net be a mountpoint
libfs: hold one mount reference for all pins
backing-file: enforce append-only and immutable backing inodes
Merge patch series "fs: fixes for aio rings, backing files and iov_iter_alignment()"
Merge patch series "pidfs: do not report fields that do not fit into the caller's struct"
ns: don't add init_ipc_ns and init_net without namespace support
Chuck Lever (1):
exportfs: Release the get_name() directory file synchronously
Daehyeon Ko (1):
splice: avoid stale f_pos writeback on error
Dominik Maier (1):
xattr: always invoke cap_convert_nscap() for security.capability writes
Edvard Conrad (1):
fs: let backing files inherit FMODE_NONOTIFY from the user file
Hungyu Lin (1):
fs: skip copy_file_range write limits when there is no data
Ihor Solodrai (1):
bpf: Allow bpf_d_path() from filp_close_sync()
Jan Kara (1):
aio: avoid request count overflow in ioctx_alloc()
Josef Bacik (7):
writeback: don't kick a missing wb for dontcache writes
fork: Let nobody keep a task that may not come to life
iomap: keep large chunks from defeating the bio cap
namei: don't assert S_ISDIR on a stale rcu-walk inode
mount: refuse setns() with a shared fs_struct again
nstree: don't end listns() at an inactive namespace
pidfs: don't let PIDFD_GET_INFO miss a reaped task
Julian Sun (2):
writeback: reset dirtied_when when switching wbs
writeback: clear old wb dirty state after inode switches
Karl Mehltretter (2):
netfs: Restore selective debug mask handling
fs: fix ramfs_fs_info leak when rootfs is unmounted
Liz Fong-Jones (1):
writeback: keep cleanup_offline_cgwb()'s scan out of syncs
Nguyen Ngoc Thang (1):
minix: reject rmdir of a directory with a corrupted link count
Nickolai Zeldovich (9):
proc/kcore: advance the vmalloc retry by the last copy, not the total
nsfs: check the trailing bytes of a file handle in bytes, not words
nsproxy: Fix cred leak in the error path of prepare_nsset()
ucount: take the rlimit reference before checking the limit
pidfs: do not report fields that do not fit into the caller's struct
selftests/pidfd: test that fields beyond the struct size are not reported
splice: retry tee() instead of returning 0 when it races
ucount: read the parent ucounts before dropping the rlimit count
fs_pin: do not trust the pin after a spurious wakeup in pin_kill()
Nikolaos Karaolidis (2):
fs: rotate inodes whose page cache could not be dropped
fs: don't lose inodes that another LRU walker is isolating
Qu Wenruo (1):
iomap: only follow dio alignment requirement if specified
Sanan Hasanov (1):
minix: restore uptodate on bitmap buffers before redirtying them
Stian Halseth (2):
fs: fix llseek() result for files with unsigned offsets
fs: allow positional I/O on files with unsigned offsets
Tianyi Chen (1):
eventpoll: propagate wakeup source creation failure in ep_modify()
Zhao Gongyi (1):
filelock: keep superblock active through delegation wait
Zhiyu Zhang (1):
watch_queue: keep info_id separate from rcu_head
Documentation/userspace-api/check_exec.rst | 4 +
block/bdev.c | 2 +-
fs/aio.c | 16 +-
fs/backing-file.c | 44 +-
fs/coredump.c | 6 +-
fs/dcache.c | 19 +-
fs/eventpoll.c | 18 +-
fs/exportfs/expfs.c | 6 +-
fs/fs-writeback.c | 18 +-
fs/fs_pin.c | 15 +-
fs/inode.c | 15 +-
fs/internal.h | 1 -
fs/iomap/bio.c | 2 +-
fs/iomap/buffered-io.c | 3 +-
fs/iomap/direct-io.c | 26 +-
fs/iomap/internal.h | 9 +
fs/iomap/ioend.c | 3 +-
fs/libfs.c | 12 +-
fs/minix/bitmap.c | 26 +-
fs/minix/namei.c | 4 +
fs/namei.c | 10 +-
fs/namespace.c | 9 +-
fs/netfs/internal.h | 32 +-
fs/nsfs.c | 4 +-
fs/pidfs.c | 51 ++-
fs/proc/generic.c | 5 +-
fs/proc/kcore.c | 8 +-
fs/read_write.c | 46 +-
fs/splice.c | 55 ++-
fs/super.c | 332 ++++++--------
fs/xattr.c | 2 +-
include/linux/filelock.h | 13 +-
include/linux/fs.h | 4 +-
include/linux/fs/super_types.h | 11 +-
include/linux/iomap.h | 3 +-
include/linux/watch_queue.h | 6 +-
init/do_mounts.c | 10 +-
ipc/namespace.c | 7 +
ipc/shm.c | 2 -
kernel/fork.c | 12 +-
kernel/nsproxy.c | 2 +-
kernel/nstree.c | 80 ++--
kernel/signal.c | 5 +-
kernel/trace/bpf_trace.c | 15 +-
kernel/ucount.c | 28 +-
kernel/user_namespace.c | 5 +-
kernel/watch_queue.c | 2 +-
lib/iov_iter.c | 4 +
net/core/net_namespace.c | 4 +-
tools/testing/selftests/Makefile | 1 +
tools/testing/selftests/bpf/prog_tests/d_path.c | 7 +-
tools/testing/selftests/bpf/progs/test_d_path.c | 2 +-
.../testing/selftests/bpf/progs/verifier_d_path.c | 21 +
tools/testing/selftests/exec/check-exec.c | 83 ++++
.../selftests/filesystems/freeze/.gitignore | 2 +
.../testing/selftests/filesystems/freeze/Makefile | 7 +
tools/testing/selftests/filesystems/freeze/config | 4 +
.../selftests/filesystems/freeze/loop_util.h | 64 +++
.../filesystems/freeze/shared_bdev_test.c | 479 +++++++++++++++++++++
.../filesystems/overlayfs/set_layers_via_fds.c | 18 +-
.../filesystems/statmount/listmount_test.c | 11 +
.../filesystems/statmount/statmount_test.c | 61 ++-
tools/testing/selftests/namespaces/listns_test.c | 34 ++
tools/testing/selftests/pidfd/pidfd.h | 16 +
tools/testing/selftests/pidfd/pidfd_info_test.c | 48 +++
65 files changed, 1462 insertions(+), 412 deletions(-)
create mode 100644 tools/testing/selftests/filesystems/freeze/.gitignore
create mode 100644 tools/testing/selftests/filesystems/freeze/Makefile
create mode 100644 tools/testing/selftests/filesystems/freeze/config
create mode 100644 tools/testing/selftests/filesystems/freeze/loop_util.h
create mode 100644 tools/testing/selftests/filesystems/freeze/shared_bdev_test.c
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-11-12 2:57 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-11-11 22:36 [GIT PULL for v7.4] vfs fixes Christian Brauner
2026-11-12 2:57 ` pr-tracker-bot
-- strict thread matches above, loose matches on Subject: below --
2026-11-10 10:47 Christian Brauner
2026-11-10 17:50 ` pr-tracker-bot
2026-10-30 17:20 Christian Brauner
2026-10-30 23:10 ` pr-tracker-bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®