[GIT PULL for v7.3] vfs fixes

[Christian Brauner <brauner@kernel.org>]

Hey Linus,

/* Summary */

This contains last fixes for the current development cycle:

- Fix a range of use-after-frees during rcu pathwalk caused by non-rcu
  frees. Whatever ->permission(), ->d_revalidate(), ->get_link(),
  ->d_hash() and ->d_compare() read in rcu mode has to be freed after a
  grace period. umount(2) hides most of it because namespace_unlock()
  waits for one, but a chdir() out of a lazily unmounted directory or
  the close() of the last file on it drops the last reference without.

  * ext4_get_link() reads the sbi and the extent status counters for a
    symlink stored in a data block. Both are freed after a grace period
    now.

  * The unicode map of casefolded ext4, f2fs and tmpfs was freed under
    generic_ci_d_hash() and generic_ci_d_compare().

  * ntfs3 with nocase freed its sbi and mount options under its dentry
    hash and compare. A remount freed the old options right away too.

  * eventfs freed an eventfs_inode after an SRCU grace period only
    while tracefs_d_revalidate() reads it under rcu_read_lock().

  * afs and 9p are only saved by the grace period their private bdi
    gets in bdi_unregister(). They stop depending on it.

  * create_ipc_ns() leaked the mqueue mount and its superblock on a
    late failure. A long-term mount needs kern_unmount().

- Don't let idle threads pin the initramfs. The idle threads of the
  secondary cpus are forked from PID 1 with a private copy of its
  fs_struct, aren't on the task list so pivot_root() never moves them
  and never exit. So the initramfs stayed pinned forever on every
  machine with more than one cpu, 70 to 150 MB in the reports. They
  share init_fs now like init_task does.

- A mount that copy_tree() leaves out can't take over a lock.
  copy_tree() drops mounts of mount namespace files from the copies it
  makes for unshare(CLONE_NEWNS) and propagation without looking at
  MNT_LOCKED. So root in a user namespace could bind a child's
  /proc/<pid>/ns/mnt beneath a locked cover, let it take the lock over,
  unshare(CLONE_NEWNS) and read the file. copy_tree() refuses with
  EPERM now and the move beneath a locked mount is refused up front.

- Revert "namei: don't reveal overmounted entries in refwalk" from the
  rc7 fixes. The bug class is bigger than that patch.

- namei: lookup_fast_for_open() checked ->d_inode while
  traverse_mounts() checks the type in d_flags, which is set second, so
  a refwalk racing the instantiation could fail an O_CREAT open with
  ENOENT. Use d_is_negative() in both places.

- Drop the smp_mb()s in mntput_no_expire_slowpath() and do_umount()
  that mnt_get_count()'s own barrier made redundant.

- fsnotify: a mark added while fsnotify_destroy_marks() walks the
  connector could be missed and the connector detached, so an fdinfo
  read called igrab(NULL). New marks are refused during teardown.

- pipe: a failed second fasync enable on an O_RDWR FIFO removed the
  existing reader entry and cleared FASYNC while the writer entry
  stayed, a use-after-free in send_sigio() later.

- watch_queue: post_one_notification() could see nr_notes before the
  note pool behind it and dereference a NULL array. An unprivileged
  user can trigger that with a key watch. Publish nr_notes last.

- pid_namespace: zap_pid_ns_processes() waits without bound for a
  tracer outside the namespace to reap its zombies and neither wait
  was freezable, so every suspend attempt failed.

- exit: is_child_subreaper and has_child_subreaper shared a word with
  other bitfields written without a common lock, so racing prctl()s
  lost a bit. They are separate bools now.

- autofs: a notification write that failed on a pipe the daemon had
  already replaced put the superblock into catatonic mode again and
  closed the replacement. Only do that for the current pipe.

- ovl: reject a lowerdir ending with an unescaped backslash with EINVAL
  instead of a confusing ENOENT later.

- ocfs2/dlm: take dlm_reco_state_lock when the debugfs state file walks
  the recovery participant list.

- samples/pidfd: fix the userprogs typo that kept pidfd-metadata from
  being built.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907:

  Linux 7.3-rc7 (2026-10-11 20:04:55 -0700)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.3-rc8.fixes

for you to fetch changes up to 214897acc8c2e5d6b63189d23ccaed6fa2af45a9:

  Revert "namei: don't reveal overmounted entries in refwalk" (2026-10-16 10:50:57 +0200)

----------------------------------------------------------------
vfs-7.3-rc8.fixes

Please consider pulling these changes from the signed vfs-7.3-rc8.fixes tag.

Thanks!
Christian

----------------------------------------------------------------
Aviv Vaknin (1):
      pid_namespace: make zap_pid_ns_processes() freezable

Cen Zhang (1):
      ocfs2/dlm: Protect the recovery list during debugfs reads

Cen Zhang (Microsoft) (1):
      watch_queue: Fix note pool publication race in watch_queue_set_size()

Christian Brauner (19):
      ext4: free the sbi after a grace period
      afs: free the super info after a grace period
      9p: free the session after a grace period
      eventfs: free the eventfs_inode after an rcu grace period too
      ipc: drop the mqueue mount with kern_unmount() on setup failure
      unicode: free the map after a grace period
      ntfs3: free the sbi after a grace period
      ntfs3: free replaced mount options after a grace period
      Merge patch series "fs: fix a range of UAFs during rcu pathwalk caused by non-rcu frees"
      fs: drop the smp_mb()s that mnt_get_count() made redundant
      Merge patch series "fs: drop the smp_mb()s that mnt_get_count() made redundant"
      fs: pass flags to copy_fs()
      namei: test for a negative dentry the way traverse_mounts() does
      namespace: a mount that copy_tree() leaves out can't take over a lock
      fs: let idle threads share init_fs
      selftests/filesystems: test that a mntns file can't take over a lock
      Merge patch series "fs: don't let idle threads pin the initramfs"
      Merge patch series "namespace: a mount that copy_tree() leaves out can't take over a lock"
      Revert "namei: don't reveal overmounted entries in refwalk"

Guanglei Zhu (1):
      ovl: reject lowerdir ending with unescaped backslash

Kyle Zeng (2):
      pipe: preserve existing fasync readers on writer setup failure
      fsnotify: prevent mark additions during connector teardown

Nickolai Zeldovich (1):
      exit: fix lost-update race on the child_subreaper bitfields

Sasha Levin (1):
      samples: pidfd: fix userprogs typo

Sung Byeongchan (1):
      autofs: ignore notification errors from a replaced pipe

 fs/9p/v9fs.h                                       |   1 +
 fs/9p/vfs_super.c                                  |   4 +-
 fs/afs/internal.h                                  |   2 +
 fs/afs/super.c                                     |   2 +-
 fs/autofs/waitq.c                                  |  25 ++++-
 fs/ext4/ext4.h                                     |   2 +
 fs/ext4/extents-test.c                             |   2 +
 fs/ext4/extents.c                                  |   1 +
 fs/ext4/extents_status.c                           |   7 +-
 fs/ext4/extents_status.h                           |   1 +
 fs/ext4/super.c                                    |  13 ++-
 fs/namei.c                                         |  32 +-----
 fs/namespace.c                                     |  33 ++++--
 fs/notify/mark.c                                   |  11 ++
 fs/ntfs3/dir.c                                     |  13 ++-
 fs/ntfs3/ntfs_fs.h                                 |   3 +
 fs/ntfs3/super.c                                   |  49 ++++++---
 fs/ocfs2/dlm/dlmcommon.h                           |   2 +
 fs/ocfs2/dlm/dlmdebug.c                            |   5 +-
 fs/ocfs2/dlm/dlmrecovery.c                         |   2 +-
 fs/overlayfs/params.c                              |   3 +
 fs/pipe.c                                          |   6 +-
 fs/tracefs/event_inode.c                           |  10 +-
 fs/unicode/utf8-core.c                             |  21 +++-
 include/linux/fsnotify_backend.h                   |   1 +
 include/linux/sched/signal.h                       |   4 +-
 include/linux/unicode.h                            |   1 +
 ipc/namespace.c                                    |   2 +-
 kernel/exit.c                                      |   2 +-
 kernel/fork.c                                      |  20 +++-
 kernel/pid_namespace.c                             |   2 +-
 kernel/watch_queue.c                               |  11 +-
 samples/pidfd/Makefile                             |   2 +-
 .../umount_propagation/locked_mount_test.c         | 122 +++++++++++++++++++++
 34 files changed, 325 insertions(+), 92 deletions(-)