[GIT PULL for v7.3] vfs fixes

[Christian Brauner <brauner@kernel.org>]

Hey Linus,

/* Summary */

This contains fixes for the current development cycle:

- Revert "put_mnt_ns(): leave mounts connected". This allows the
  creation of reference count cycles in a very trivial way. We can't
  bring this in until we have fixed the underlying cause.

- vfs: Don't create the private nullfs instance for kthreads under
  namespace_sem to avoid false lockdeps complaints.

- binfmt_misc

  * Copy the name into a stack buffer and look up the copy in
    bpf_binprm_select_interp().

  * bpf_binprm_set_interp() and bpf_binprm_set_interp_arg(): Check the
    private copy instead so the string that gets staged is the kstring
    that was checked.

- netfs

  * Make netfs_read_gaps() use separate sink folios rather than one
    reused sink folio to discard unwanted data so that cifs checksum
    checking sees all the data that was fetched.

  * Trim reads down to i_size so afs symlinks read correctly from the
    cache.

  * Wrap the direct mempool ->alloc() calls the GFP_KERNEL paths make
    in alloc_hooks() via a new mempool_alloc_noreserve() helper.

- iov_iter: Use iov_iter_alignment() for the start and length check
  added to iov_iter_extract_bvecs() this cycle. It used iter_iov_addr()
  and iter_iov_len() which are only valid for ITER_UBUF and ITER_IOVEC
  iterators.

- super: Make iterate_supers_type() deletion-safe.

- inode: Stop evict_inodes() from rescanning the same inodes.

- writeback: Bound the cleanup_offline_cgwb() rescans.

- ntfs3: Use d_instantiate_new() in ntfs_create_inode().

- ovl: Fix a use-after-free in the ovl_do_mkdir() debug print.

- dcache: Unpoison the inline name buffer in __d_alloc() for KMSAN.

- autofs: Fix a pipe file reference leak in autofs_kill_sb().

- bpf: Drop the path_unlink and path_rmdir hooks from the list of hooks
  for which the verifier rewrites bpf_{set,remove}_dentry_xattr() to
  the _locked variants.

- squashfs: Range check the xz dictionary size before shifting by it.

- selftests: Add the missing eventfd, open_tree_ns, openat2 and xattr
  filesystems selftests to TARGETS and drop the stale openat2 entry
  left behind when those tests moved.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit 50d05c7c76c96b90462f24debacca971d2e86713:

  Merge tag 'landlock-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux (2026-09-09 11:00:35 -0700)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.3-rc5.fixes

for you to fetch changes up to b78b728e21c32ec4c330b299f657fb1eb02dffc2:

  netfs: Fix missing alloc tagging of direct mempool allocations (2026-09-25 17:30:39 +0200)

----------------------------------------------------------------
vfs-7.3-rc5.fixes

Please consider pulling these changes from the signed vfs-7.3-rc5.fixes tag.

Thanks!
Christian

----------------------------------------------------------------
Amir Goldstein (1):
      ovl: fix UAF in ovl_do_mkdir() debug print

Andrea Parri (1):
      bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

Chris Mason (2):
      binfmt_misc: fix OOB read in bpf_binprm_select_interp()
      binfmt_misc: fix racy checks in bpf set_interp kfuncs

Christian Brauner (7):
      fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
      fs: don't create the private nullfs mount under namespace_sem
      Merge patch series "binfmt: fixes for kres reports"
      Revert "selftests/filesystems: add mntns cleanup test"
      Revert "put_mnt_ns(): leave mounts connected"
      Merge patch series "Revert "put_mnt_ns(): leave mounts connected""
      super: make iterate_supers_type() deletion-safe

David Howells (3):
      block: Fix start and length check added to iov_iter_extract_bvecs()
      netfs: Fix netfs_read_gaps() to use separate sink folios
      netfs, afs: Fix symlink reading

Disha Goel (1):
      selftests/filesystems: fix missing and stale TARGETS entries

Drif Abdelmalek Mohamed Said (1):
      dcache: unpoison the inline name buffer in __d_alloc()

Hao Ge (1):
      netfs: Fix missing alloc tagging of direct mempool allocations

Hui Peng (1):
      autofs: fix sbi->pipe file reference leak in autofs_kill_sb()

Julian Sun (1):
      fs: avoid repeated scans in evict_inodes()

Patrick Lu (Anthropic) (1):
      writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes

Ran Hongyun (1):
      squashfs: Add dictionary size range check to prevent shift-out-of-bounds

 fs/autofs/inode.c                                  |  4 ++
 fs/binfmt_misc_bpf.c                               | 35 +++++++++++--
 fs/bpf_fs_kfuncs.c                                 |  4 --
 fs/dcache.c                                        |  4 ++
 fs/fs-writeback.c                                  | 25 ++++++++--
 fs/inode.c                                         | 11 ++--
 fs/kernfs/mount.c                                  |  4 +-
 fs/namespace.c                                     | 27 ++++++----
 fs/netfs/buffered_read.c                           | 34 +++++++------
 fs/netfs/objects.c                                 |  4 +-
 fs/netfs/read_collect.c                            |  5 ++
 fs/netfs/rolling_buffer.c                          |  2 +-
 fs/ntfs3/inode.c                                   |  7 +--
 fs/overlayfs/overlayfs.h                           |  4 +-
 fs/squashfs/xz_wrapper.c                           |  6 +--
 fs/super.c                                         | 39 +++++++--------
 include/linux/mempool.h                            |  7 +++
 lib/iov_iter.c                                     | 18 ++++++-
 tools/testing/selftests/Makefile                   |  6 ++-
 .../selftests/filesystems/mntns_cleanup/.gitignore |  2 -
 .../selftests/filesystems/mntns_cleanup/Makefile   |  6 ---
 .../filesystems/mntns_cleanup/mntns_cleanup_test.c | 58 ----------------------
 22 files changed, 165 insertions(+), 147 deletions(-)
 delete mode 100644 tools/testing/selftests/filesystems/mntns_cleanup/.gitignore
 delete mode 100644 tools/testing/selftests/filesystems/mntns_cleanup/Makefile
 delete mode 100644 tools/testing/selftests/filesystems/mntns_cleanup/mntns_cleanup_test.c