* [GIT PULL for v7.3] vfs fixes
@ 2026-09-09 13:44 Christian Brauner
2026-09-09 18:38 ` pr-tracker-bot
0 siblings, 1 reply; 4+ messages in thread
From: Christian Brauner @ 2026-09-09 13:44 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This contains fixes for the current development cycle:
- netfs:
* Fix an uninitialized return value in netfs_unbuffered_write() when
preparing the first subrequest fails.
* For partial unbuffered/DIO writes return the amount transferred
rather than an error.
* Update i_size with the amount actually written when a partial
transfer ends in an error.
* Fix a subrequest reference leak when the io_iter ends up empty.
* Handle netfs_alloc_subrequest() failure during unbuffered writes.
* Load all readahead folios into the rolling buffer upfront and drop
the readahead references once the first subrequest is dispatched.
* Mark folios for copy-to-cache while issuing subrequests.
* Fix read progress reporting.
- afs:
* Add the missing kunmap in the error path of afs_dir_search_bucket().
* Fix a double kunmap in afs_edit_dir_remove().
* Don't free an existing server's endpoint state when cleaning up a
candidate server in afs_lookup_server().
* Unbind peers removed from a server's address list.
- ufs:
* Load the cylinder group metadata before creating the root dentry.
* Validate the cylinder group index and rotor positions before
caching them.
* Treat an unreadable directory block as not empty.
- exec:
* Close the close-on-exec files before taking exec_update_lock.
Closing a file can block on the filesystem, so a hung filesystem
blocked everything that takes exec_update_lock and a FUSE server
inspecting the calling process could deadlock.
* Drop the bprm loader before closing bprm->file in free_bprm().
- exit: Hold a reference to thread_pid across proc_flush_pid().
- reboot: Fix a use-after-free on cad_pid.
- nsfs: Keep the namespace tree fields out of the rcu_head used by
kfree_rcu().
- nstree: Check listing permission before taking a namespace reference
in listns().
- super: Return 0 when a nested thaw drops its hold while other
freezers remain.
- ext4: Don't set I_METADATA_WRITEBACK during fastcommit replay.
- adfs: Free s_fs_info in ->kill_sb()..
- autofs: Free the inode info allocated in autofs_fill_super() when the
root inode allocation fails.
- ovl: Return EINVAL instead of EIO on a user namespace mismatch now
that it's a plain refusal and not an internal error.
- cachefiles: Don't cast the variable-length coherency data to a __be64
in the coherency tracepoint.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit 818bebeb63dd6bf5f4e07e145f6cdbace520a34c:
drm/xe: Don't hand out the flat CCS storage as usable VRAM (2026-08-20 20:12:39 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.3-rc3.fixes
for you to fetch changes up to 56ea4e86832d8abe8930394473566c194d189f85:
nstree: check listing permission before taking a namespace reference (2026-09-09 10:03:15 +0200)
----------------------------------------------------------------
vfs-7.3-rc3.fixes
Please consider pulling these changes from the signed vfs-7.3-rc3.fixes tag.
Thanks!
Christian
----------------------------------------------------------------
Ahmet Eray Karadag (1):
adfs: fix memory leak in sb->s_fs_info
Ali Ahmet Memis (3):
ufs: create the root dentry after loading cylinder metadata
ufs: validate cylinder group metadata before caching it
ufs: do not treat unreadable directory blocks as empty
Cen Zhang (Microsoft) (1):
reboot: fix cad_pid use-after-free race
Chengfeng Ye (1):
afs: Clear stale peer app data after address list changes
Christian Brauner (3):
Merge patch series "ufs: harden the mount path against malformed images"
Merge patch series "netfs, cachefiles: Miscellaneous fixes"
Merge patch series "afs: Miscellaneous fixes"
Daehyeon Ko (1):
exit: hold a reference to thread_pid across proc_flush_pid
David Howells (11):
netfs: Fix unbuffered/DIO write partial transfer error return
netfs: Fix error vs transferred passed to ->ki_complete()
netfs: Fix i_size update for partial transfer
netfs: Fix subreq ref leak
netfs: Fix readahead synchronisation issues by loading all folios upfront
netfs: Mark folios with COPY_TO_CACHE whilst issuing subreqs
netfs: Fix read progress reporting
cachefiles: Fix potential UAF/KASAN warning
afs: Fix missing kunmap in afs_dir_search_bucket()
afs: Fix double-unmap of directory block
afs: Fix incorrect free in candidate cleanup in afs_lookup_server()
Edward Adam Davis (1):
netfs: break unbuffered write when netfs_alloc_subrequest() fails
Jan Kara (1):
ext4: Avoid entering writeback paths during fastcommit replay
Jann Horn (1):
exec: do_close_on_exec() before taking exec_update_lock
Jeffin Philip (1):
fs: autofs: fix memory leak in autofs_fill_super()
Jérémy Jean (1):
nsfs: keep namespace tree fields stable until after RCU grace period
Karl Mehltretter (1):
netfs: Fix uninitialized return value in netfs_unbuffered_write()
Miklos Szeredi (1):
ovl: return EINVAL instead of EIO in case of mismatched user_ns
Moritz Tanner (1):
fs: don't return -EINVAL for successful nested thaw
Norbert Szetei (1):
nstree: check listing permission before taking a namespace reference
Sun Jian (1):
exec: Drop bprm loader before closing bprm->file
fs/adfs/super.c | 24 +++---
fs/afs/addr_list.c | 5 +-
fs/afs/dir_edit.c | 9 +-
fs/afs/dir_search.c | 11 +--
fs/afs/fs_probe.c | 1 +
fs/afs/internal.h | 8 ++
fs/afs/server.c | 1 -
fs/autofs/inode.c | 4 +-
fs/cachefiles/xattr.c | 16 ++--
fs/exec.c | 24 ++++--
fs/ext4/inode.c | 11 ++-
fs/netfs/buffered_read.c | 164 +++++++++++++++++++++++++++----------
fs/netfs/direct_write.c | 31 ++++---
fs/netfs/internal.h | 3 +
fs/netfs/misc.c | 19 +++++
fs/netfs/objects.c | 32 +++++---
fs/netfs/read_collect.c | 128 ++++++++++++++++++++---------
fs/netfs/read_pgpriv2.c | 15 ++--
fs/netfs/read_retry.c | 13 ++-
fs/netfs/read_single.c | 2 +
fs/netfs/rolling_buffer.c | 79 +++++++++++-------
fs/netfs/write_issue.c | 2 +
fs/overlayfs/super.c | 2 +-
fs/super.c | 9 +-
fs/ufs/cylinder.c | 10 +++
fs/ufs/dir.c | 2 +-
fs/ufs/super.c | 17 ++--
include/linux/netfs.h | 5 +-
include/linux/ns/ns_common_types.h | 6 +-
include/linux/rolling_buffer.h | 6 +-
include/linux/sched.h | 2 +-
include/linux/sched/signal.h | 5 +-
include/trace/events/cachefiles.h | 19 ++++-
include/trace/events/netfs.h | 30 ++++++-
init/main.c | 2 +-
kernel/exit.c | 9 +-
kernel/nstree.c | 10 +--
kernel/reboot.c | 19 ++++-
kernel/signal.c | 12 +++
39 files changed, 532 insertions(+), 235 deletions(-)
^ permalink raw reply [flat|nested] 4+ messages in thread* [GIT PULL for v7.3] vfs fixes
@ 2026-09-25 16:19 Christian Brauner
2026-09-25 18:41 ` pr-tracker-bot
0 siblings, 1 reply; 4+ messages in thread
From: Christian Brauner @ 2026-09-25 16:19 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This contains fixes for the current development cycle:
- Revert "put_mnt_ns(): leave mounts connected". This allows the
creation of reference count cycles in a very trivial way. We can't
bring this in until we have fixed the underlying cause.
- vfs: Don't create the private nullfs instance for kthreads under
namespace_sem to avoid false lockdeps complaints.
- binfmt_misc
* Copy the name into a stack buffer and look up the copy in
bpf_binprm_select_interp().
* bpf_binprm_set_interp() and bpf_binprm_set_interp_arg(): Check the
private copy instead so the string that gets staged is the kstring
that was checked.
- netfs
* Make netfs_read_gaps() use separate sink folios rather than one
reused sink folio to discard unwanted data so that cifs checksum
checking sees all the data that was fetched.
* Trim reads down to i_size so afs symlinks read correctly from the
cache.
* Wrap the direct mempool ->alloc() calls the GFP_KERNEL paths make
in alloc_hooks() via a new mempool_alloc_noreserve() helper.
- iov_iter: Use iov_iter_alignment() for the start and length check
added to iov_iter_extract_bvecs() this cycle. It used iter_iov_addr()
and iter_iov_len() which are only valid for ITER_UBUF and ITER_IOVEC
iterators.
- super: Make iterate_supers_type() deletion-safe.
- inode: Stop evict_inodes() from rescanning the same inodes.
- writeback: Bound the cleanup_offline_cgwb() rescans.
- ntfs3: Use d_instantiate_new() in ntfs_create_inode().
- ovl: Fix a use-after-free in the ovl_do_mkdir() debug print.
- dcache: Unpoison the inline name buffer in __d_alloc() for KMSAN.
- autofs: Fix a pipe file reference leak in autofs_kill_sb().
- bpf: Drop the path_unlink and path_rmdir hooks from the list of hooks
for which the verifier rewrites bpf_{set,remove}_dentry_xattr() to
the _locked variants.
- squashfs: Range check the xz dictionary size before shifting by it.
- selftests: Add the missing eventfd, open_tree_ns, openat2 and xattr
filesystems selftests to TARGETS and drop the stale openat2 entry
left behind when those tests moved.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit 50d05c7c76c96b90462f24debacca971d2e86713:
Merge tag 'landlock-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux (2026-09-09 11:00:35 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.3-rc5.fixes
for you to fetch changes up to b78b728e21c32ec4c330b299f657fb1eb02dffc2:
netfs: Fix missing alloc tagging of direct mempool allocations (2026-09-25 17:30:39 +0200)
----------------------------------------------------------------
vfs-7.3-rc5.fixes
Please consider pulling these changes from the signed vfs-7.3-rc5.fixes tag.
Thanks!
Christian
----------------------------------------------------------------
Amir Goldstein (1):
ovl: fix UAF in ovl_do_mkdir() debug print
Andrea Parri (1):
bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
Chris Mason (2):
binfmt_misc: fix OOB read in bpf_binprm_select_interp()
binfmt_misc: fix racy checks in bpf set_interp kfuncs
Christian Brauner (7):
fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
fs: don't create the private nullfs mount under namespace_sem
Merge patch series "binfmt: fixes for kres reports"
Revert "selftests/filesystems: add mntns cleanup test"
Revert "put_mnt_ns(): leave mounts connected"
Merge patch series "Revert "put_mnt_ns(): leave mounts connected""
super: make iterate_supers_type() deletion-safe
David Howells (3):
block: Fix start and length check added to iov_iter_extract_bvecs()
netfs: Fix netfs_read_gaps() to use separate sink folios
netfs, afs: Fix symlink reading
Disha Goel (1):
selftests/filesystems: fix missing and stale TARGETS entries
Drif Abdelmalek Mohamed Said (1):
dcache: unpoison the inline name buffer in __d_alloc()
Hao Ge (1):
netfs: Fix missing alloc tagging of direct mempool allocations
Hui Peng (1):
autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
Julian Sun (1):
fs: avoid repeated scans in evict_inodes()
Patrick Lu (Anthropic) (1):
writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
Ran Hongyun (1):
squashfs: Add dictionary size range check to prevent shift-out-of-bounds
fs/autofs/inode.c | 4 ++
fs/binfmt_misc_bpf.c | 35 +++++++++++--
fs/bpf_fs_kfuncs.c | 4 --
fs/dcache.c | 4 ++
fs/fs-writeback.c | 25 ++++++++--
fs/inode.c | 11 ++--
fs/kernfs/mount.c | 4 +-
fs/namespace.c | 27 ++++++----
fs/netfs/buffered_read.c | 34 +++++++------
fs/netfs/objects.c | 4 +-
fs/netfs/read_collect.c | 5 ++
fs/netfs/rolling_buffer.c | 2 +-
fs/ntfs3/inode.c | 7 +--
fs/overlayfs/overlayfs.h | 4 +-
fs/squashfs/xz_wrapper.c | 6 +--
fs/super.c | 39 +++++++--------
include/linux/mempool.h | 7 +++
lib/iov_iter.c | 18 ++++++-
tools/testing/selftests/Makefile | 6 ++-
.../selftests/filesystems/mntns_cleanup/.gitignore | 2 -
.../selftests/filesystems/mntns_cleanup/Makefile | 6 ---
.../filesystems/mntns_cleanup/mntns_cleanup_test.c | 58 ----------------------
22 files changed, 165 insertions(+), 147 deletions(-)
delete mode 100644 tools/testing/selftests/filesystems/mntns_cleanup/.gitignore
delete mode 100644 tools/testing/selftests/filesystems/mntns_cleanup/Makefile
delete mode 100644 tools/testing/selftests/filesystems/mntns_cleanup/mntns_cleanup_test.c
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-25 18:43 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-09 13:44 [GIT PULL for v7.3] vfs fixes Christian Brauner
2026-09-09 18:38 ` pr-tracker-bot
2026-09-25 16:19 Christian Brauner
2026-09-25 18:41 ` pr-tracker-bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®