[GIT PULL 09/19 for v7.4] vfs file

[Christian Brauner <brauner@kernel.org>]

Hey Linus,

/* Summary */

This annotates struct fdtable's fd array with __counted_by_ptr so KASAN
and the fortified functions can bounds check it against max_fds and
adds a KUnit suite for fdtable. A follow-up uses __struct_size() in the
test since sparse doesn't know __builtin_dynamic_object_size().

FD_PREPARE() is simplified. It was built as an ACQUIRE-style guard on
infrastructure that was never needed. The ACQUIRE machinery and
CLASS_INIT() go away, the variable is declared with __cleanup()
directly, struct fd_prepare loses its err field since the fd either
holds the descriptor or the error, and callers get a const pointer to
the guard behind a UNIQUE_ID() name so they can't shadow it. Code
generation is identical.

/* Testing */

No build failures or warnings were observed.

/* Conflicts */

Merge conflicts with mainline
=============================

This conflicts with mainline in fs/namespace.c between commit
7253a6ff640df ("namespace: drop the file's reference first in
dissolve_on_fput()") in mainline and commit 64cbb36448ff2 ("file: make
struct fd_prepare const and kill its err field") from this tree:

diff --cc fs/namespace.c
index 59fb227df39f,0f5c00816775..000000000000
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@@ -4701,9 -4544,9 +4701,9 @@@ SYSCALL_DEFINE3(fsmount, int, fs_fd, un
  
  	FD_PREPARE(fdf, (flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0,
  		   dentry_open(&new_path, O_PATH, fc->cred));
- 	if (fdf.err) {
+ 	if (fdf->fd < 0) {
 -		dissolve_on_fput(new_path.mnt);
 +		dissolve_on_fput(no_free_ptr(new_path.mnt));
- 		return fdf.err;
+ 		return fdf->fd;
  	}
  
  	/*

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:

  Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.file

for you to fetch changes up to fae37d5e3c4e94aef334825ab89f66efcfe489b2:

  Merge patch series "file: simplify and harden cleanup handling" (2026-09-23 09:28:02 +0200)

----------------------------------------------------------------
vfs-7.4-rc1.file

Please consider pulling these changes from the signed vfs-7.4-rc1.file tag.

Thanks!
Christian

----------------------------------------------------------------
Bill Wendling (2):
      vfs: Annotate struct fdtable's fd field with __counted_by_ptr
      vfs: Add KUnit tests for fdtable

Christian Brauner (7):
      Merge patch series "vfs: Annotate struct fdtable's fd field with __counted_by_ptr"
      vfs: use __struct_size() in the fdtable KUnit test
      file: simplify FD_PREPARE()
      file: declare the FD_PREPARE() variable with __cleanup() directly
      cleanup: remove CLASS_INIT()
      file: make struct fd_prepare const and kill its err field
      Merge patch series "file: simplify and harden cleanup handling"

 arch/powerpc/platforms/cell/spufs/inode.c |  12 +--
 drivers/gpio/gpiolib-cdev.c               |  18 ++---
 drivers/gpu/drm/msm/msm_perfcntr.c        |   4 +-
 drivers/media/mc/mc-request.c             |   8 +-
 drivers/misc/ntsync.c                     |   6 +-
 fs/Kconfig                                |   8 ++
 fs/eventfd.c                              |   4 +-
 fs/eventpoll.c                            |   6 +-
 fs/file.c                                 |  12 ++-
 fs/namespace.c                            |  12 +--
 fs/nsfs.c                                 |   4 +-
 fs/tests/.kunitconfig                     |   2 +
 fs/tests/fdtable_kunit.c                  |  72 +++++++++++++++++
 fs/xfs/xfs_handle.c                       |   6 +-
 include/linux/cleanup.h                   |   7 --
 include/linux/fdtable.h                   |   2 +-
 include/linux/file.h                      | 130 +++++++++++-------------------
 io_uring/mock_file.c                      |   8 +-
 kernel/bpf/bpf_iter.c                     |   6 +-
 kernel/bpf/token.c                        |   6 +-
 mm/userfaultfd.c                          |   6 +-
 net/core/scm.c                            |   8 +-
 net/handshake/netlink.c                   |   8 +-
 net/kcm/kcmsock.c                         |   6 +-
 24 files changed, 204 insertions(+), 157 deletions(-)
 create mode 100644 fs/tests/.kunitconfig
 create mode 100644 fs/tests/fdtable_kunit.c