* [GIT PULL 01/19 for v7.4] ipc misc
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
@ 2026-10-16 10:14 ` Christian Brauner
2026-10-16 10:15 ` [GIT PULL 02/19 for v7.4] kernel signal Christian Brauner
` (17 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:14 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This fixes a leak in mqueue. A task in another thread group sharing the
file table could register an mq_notify() and exit without closing the
queue. The registration was never torn down and pinned the notification
skb, the netlink socket, a pid reference and a user namespace reference
forever. Stale registrations are released on inode eviction now.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/ipc-7.4-rc1.misc
for you to fetch changes up to eb85469f0dd69ca145d63117450e14c31f67f698:
ipc/mqueue: release notification resources during inode eviction (2026-08-31 12:30:30 +0200)
----------------------------------------------------------------
ipc-7.4-rc1.misc
Please consider pulling these changes from the signed ipc-7.4-rc1.misc tag.
Thanks!
Christian
----------------------------------------------------------------
Daehyeon Ko (1):
ipc/mqueue: release notification resources during inode eviction
ipc/mqueue.c | 7 +++++++
1 file changed, 7 insertions(+)
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 02/19 for v7.4] kernel signal
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
2026-10-16 10:14 ` [GIT PULL 01/19 for v7.4] ipc misc Christian Brauner
@ 2026-10-16 10:15 ` Christian Brauner
2026-10-16 10:15 ` [GIT PULL 03/19 for v7.4] namespace misc Christian Brauner
` (16 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:15 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This stops TIF_NOTIFY_SIGNAL from interrupting work that can't be
restarted and fixes a bunch of coredump and signal bugs.
TIF_NOTIFY_SIGNAL kicks a task out of an uninterruptible sleep so it
returns to userspace, runs its task work and goes back to sleep. That
breaks coredumps. dump_interrupted() only lets fatal signals interrupt
a dump and writes to a regular file ignore TIF_NOTIFY_SIGNAL. But the
pipe and the socket paths check signal_pending() deep down in code that
is shared with regular syscalls and bail. So a crashing process with
io_uring requests in flight loses most of its coredump. In the selftest
an unfixed kernel delivers 357324 of at least 5111808 bytes. And
io_uring isn't the only source. klp_send_signals(),
bpf_task_work_schedule_signal(), landlock's tsync, kthread_stop() and
the printk kunit test raise the bit as well, some of them from irq
context against any task. So this can't be fixed per subsystem and the
state has to be per-task and ambient.
Add PF_NO_NOTIFY_SIGNAL and no_notify_signal_save()/restore() helpers
modelled on memalloc_nofs_save(). Inside such a section
signal_pending() ignores TIF_NOTIFY_SIGNAL. Coredumps, the smb send
path, which hand-rolled its own version of this, and the pid namespace
reaper, which busy-looped when the bit kept getting raised, are
converted.
The second part is a set of fixes that fell out of looking at the
coredump code with kres and modelling it in TLA+:
- coredump_finish() woke the parked threads without holding rcu. A
parked thread can exit on a spurious wakeup and be freed before
wake_up_process() takes its pi_lock.
- Only SIGKILL and the freezers interrupt a dump now and the three
freezers agree. Power management and cgroup v1 freezing aborted a
dump while a cgroup v2 freeze either waited for the dump or cut it
short depending on where the core went.
- io-wq set its exit bit without a barrier against the task work that
creates workers. On weakly ordered architectures exit could hang on
worker_done.
- retarget_shared_pending() slingshotted a shared signal to the dumper
when a zapped sibling restored its signal mask. That set
TIF_SIGPENDING on the dumper and truncated the core.
- A tracer could clear the signal mask of a user worker with
PTRACE_SETSIGMASK and inject a coredump signal. An io-wq worker of an
SQPOLL ring dumping core deadlocks the whole group. PTRACE_SETSIGMASK
is refused for user workers now and __set_task_blocked() enforces the
fork-time mask.
- exec cancels io_uring requests before de_thread() so a worker
creation queued as task work can't add a thread to a thread group
that de_thread() just took down.
- No io threads are created from a PF_SIGNALED or PF_POSTCOREDUMP
creator anymore. Such a worker was invisible to zap_process() but
still decremented threads_remaining on exit so the dumper could leave
coredump_wait_inactive() early.
Also included are a comment that do_each_pid_task() needs
tasklist_lock, a READ_ONCE() in pid_alive() and a regression test for
fork() into a pid namespace whose ancestor lost its init.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
This conflicts with the cifs tree in fs/smb/client/transport.c between
commit 80f49404968d6 ("smb: client: fast fail sends if need to
reconnect") from the cifs tree and commit d0ae35565f5d5 ("smb: prevent
TIF_NOTIFY_SIGNAL from interrupting") from this tree. The cifs tree
bails out early after sock_sendmsg() when a reconnect is needed and
this tree wraps the call in a no_notify_signal guard and drops the
EINTR special case below it:
diff --cc fs/smb/client/transport.c
index cf11af490b0d,93ff6a4dbb35..60699d2799fb
--- a/fs/smb/client/transport.c
+++ b/fs/smb/client/transport.c
@@@ -171,26 -170,11 +170,22 @@@ smb_send_kvec(struct TCP_Server_Info *s
* after the retries we will kill the socket and
* reconnect which may clear the network problem.
*
- * Even if regular signals are masked, EINTR might be
- * propagated from sk_stream_wait_memory() to here when
- * TIF_NOTIFY_SIGNAL is used for task work. For example,
- * certain io_uring completions will use that. Treat
- * having EINTR with pending task work the same as EAGAIN
- * to avoid unnecessary reconnects.
+ * Task work must not abort the send, see signal_pending().
*/
- rc = sock_sendmsg(ssocket, smb_msg);
+ scoped_guard(no_notify_signal)
+ rc = sock_sendmsg(ssocket, smb_msg);
+
+ /*
+ * If need to reconnect, blame it for any non-interrupt error
+ * and bail out early, even if -EAGAIN; reconnect will never
+ * happen in parallel as cifs_reconnect() needs server mutex
+ * (which we're already holding), so it's pointless to retry.
+ */
+ if (unlikely(rc <= 0 && !is_interrupt_error(rc) &&
+ READ_ONCE(server->tcpStatus) == CifsNeedReconnect))
+ return -ECONNRESET;
+
- if (rc == -EAGAIN || unlikely(rc == -EINTR && task_work_pending(current))) {
+ if (rc == -EAGAIN) {
retries++;
if (retries >= 14 ||
(!server->noblocksnd && (retries > 2))) {
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/kernel-7.4-rc1.signal
for you to fetch changes up to 12e19bba68ba4ef222033ff9a3b63df07b7fad38:
pid: use READ_ONCE() in pid_alive() (2026-10-12 11:13:01 +0200)
----------------------------------------------------------------
kernel-7.4-rc1.signal
Please consider pulling these changes from the signed kernel-7.4-rc1.signal tag.
Thanks!
Christian
----------------------------------------------------------------
Babanpreet Singh (1):
pid: use READ_ONCE() in pid_alive()
Christian Brauner (20):
signal: allow taks to temporarily block TIF_NOTIFY_SIGNAL
coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps
selftests/coredump: test that TIF_NOTIFY_SIGNAL doesn't truncate a coredump
smb: prevent TIF_NOTIFY_SIGNAL from interrupting
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
Merge patch series "Stop TIF_NOTIFY_SIGNAL from interrupting work that can't be restarted"
coredump: hold RCU while releasing parked threads
io-wq: order the exit bit against worker creation task work
signal: don't retarget shared signals in a dying thread group
signal: only SIGKILL and the freezers interrupt a coredumping task
selftests/coredump: test shared signal retargeting during a dump
ptrace: refuse to change the signal mask of a user worker
selftests/coredump: test a user worker as the coredumping thread
selftests/coredump: expect PTRACE_SETSIGMASK to be refused on a user worker
exec: cancel io_uring requests before de_thread()
fork: move the coredump and exec checks into create_io_thread()
fork: don't create io threads once PF_POSTCOREDUMP is set
fork: use SIG_KERNEL_ONLY_MASK for the user worker signal mask
signal: enforce the user worker signal mask in __set_task_blocked()
Merge patch series "coredump & signals: an impossible affair"
Oleg Nesterov (1):
pid: document that do_each_pid_task() needs tasklist_lock
Sahaj Chaudhari (1):
selftests: pid_namespace: test fork with dead ancestor
fs/coredump.c | 18 +-
fs/exec.c | 11 +-
fs/smb/client/transport.c | 13 +-
include/linux/pid.h | 11 +-
include/linux/sched.h | 2 +-
include/linux/sched/signal.h | 27 +-
io_uring/io-wq.c | 2 +
kernel/fork.c | 11 +-
kernel/pid.c | 2 +-
kernel/pid_namespace.c | 3 +-
kernel/ptrace.c | 6 +
kernel/signal.c | 14 +
tools/testing/selftests/coredump/.gitignore | 2 +
tools/testing/selftests/coredump/Makefile | 11 +-
.../selftests/coredump/coredump_notify_signal.h | 29 ++
.../coredump/coredump_notify_signal_helper.c | 46 +++
.../coredump/coredump_notify_signal_test.c | 245 +++++++++++
.../selftests/coredump/coredump_signal_test.c | 238 +++++++++++
tools/testing/selftests/coredump/coredump_test.h | 1 +
.../selftests/coredump/coredump_test_helpers.c | 311 ++++++++++++++
.../selftests/coredump/coredump_worker_test.c | 447 +++++++++++++++++++++
tools/testing/selftests/pid_namespace/.gitignore | 1 +
tools/testing/selftests/pid_namespace/Makefile | 2 +-
.../selftests/pid_namespace/pidns_dead_ancestor.c | 174 ++++++++
24 files changed, 1593 insertions(+), 34 deletions(-)
create mode 100644 tools/testing/selftests/coredump/coredump_notify_signal.h
create mode 100644 tools/testing/selftests/coredump/coredump_notify_signal_helper.c
create mode 100644 tools/testing/selftests/coredump/coredump_notify_signal_test.c
create mode 100644 tools/testing/selftests/coredump/coredump_signal_test.c
create mode 100644 tools/testing/selftests/coredump/coredump_worker_test.c
create mode 100644 tools/testing/selftests/pid_namespace/pidns_dead_ancestor.c
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 03/19 for v7.4] namespace misc
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
2026-10-16 10:14 ` [GIT PULL 01/19 for v7.4] ipc misc Christian Brauner
2026-10-16 10:15 ` [GIT PULL 02/19 for v7.4] kernel signal Christian Brauner
@ 2026-10-16 10:15 ` Christian Brauner
2026-10-16 10:16 ` [GIT PULL 04/19 for v7.4] vfs bfs Christian Brauner
` (15 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:15 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
- Reject uid_map, gid_map and projid_map values that don't fit in a
u32. map_write() parsed with simple_strtoul() and truncated modulo
2^32 on 64-bit so "4294967301 1000 1" was installed as "5 1000 1"
without an error. Each field is parsed with kstrtou32() now and
selftests cover the out-of-range, negative and in-range cases. This
isn't a security fix. The truncated values were valid ids and every
later check still applied to them.
- Annotate struct uid_gid_map's forward and reverse pointers with
__counted_by_ptr and add a KUnit suite for inserting and sorting
extents. insert_extent() wrote to forward[nr_extents] before bumping
the count which the annotation flags, so it bumps first now. Two
follow-up fixes rename the now global helpers to
uid_gid_map_insert_extent() and uid_gid_map_sort(), since the btrfs
self-tests have their own insert_extent(), and guard the declarations
on CONFIG_KUNIT.
- Drop the BUG_ON() NULL checks in copy_mnt_ns() and copy_utsname().
create_new_namespaces() always passes a valid pointer and the other
copy_*_ns() helpers don't check either.
- Remove a dead key_put() on the create_user_ns() error path.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/namespace-7.4-rc1.misc
for you to fetch changes up to fbc59bc7f05c62b0c1607b92eaf8175e75ef755d:
Merge patch series "userns: reject out-of-range uid_map/gid_map values" (2026-10-12 11:01:24 +0200)
----------------------------------------------------------------
namespace-7.4-rc1.misc
Please consider pulling these changes from the signed namespace-7.4-rc1.misc tag.
Thanks!
Christian
----------------------------------------------------------------
Bill Wendling (2):
userns: Add __counted_by_ptr attribute to struct uid_gid_map
userns: Add KUnit test suite for uid_gid_map
Christian Brauner (6):
Merge patch series "drop BUG_ON() NULL checks in namespace copy helpers"
Merge patch series "userns: Add __counted_by_ptr attribute to struct uid_gid_map"
userns: rename insert_extent() and sort_idmaps()
userns: declare the KUnit-visible helpers whenever KUnit is enabled
Merge patch series "Minor bugfixes for kunit userns tests"
Merge patch series "userns: reject out-of-range uid_map/gid_map values"
Natasha Klaus (2):
userns: reject uid_map/gid_map values that do not fit in u32
selftests/namespaces: add uid_map/gid_map range tests
Shaojie Sun (2):
uts: drop BUG_ON() in copy_utsname()
fs: namespace: drop BUG_ON() in copy_mnt_ns()
Tao Cui (1):
userns: remove dead key_put() on the create_user_ns() error path
fs/namespace.c | 2 -
include/linux/user_namespace.h | 11 +-
init/Kconfig | 11 +
kernel/Makefile | 1 +
kernel/tests/.kunitconfig | 4 +
kernel/tests/user_ns_map_kunit.c | 98 +++++++
kernel/user_namespace.c | 61 +++--
kernel/utsname.c | 1 -
tools/testing/selftests/namespaces/.gitignore | 1 +
tools/testing/selftests/namespaces/Makefile | 3 +-
.../selftests/namespaces/uid_map_range_test.c | 299 +++++++++++++++++++++
11 files changed, 470 insertions(+), 22 deletions(-)
create mode 100644 kernel/tests/.kunitconfig
create mode 100644 kernel/tests/user_ns_map_kunit.c
create mode 100644 tools/testing/selftests/namespaces/uid_map_range_test.c
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 04/19 for v7.4] vfs bfs
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (2 preceding siblings ...)
2026-10-16 10:15 ` [GIT PULL 03/19 for v7.4] namespace misc Christian Brauner
@ 2026-10-16 10:16 ` Christian Brauner
2026-10-16 10:16 ` [GIT PULL 05/19 for v7.4] vfs bh Christian Brauner
` (14 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:16 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This removes bfs, the filesystem UnixWare uses for its boot partition.
It only supports contiguous files and has no subdirectories. The only
data on such a partition are kernels and bootloader settings so there
is no reason to access it from Linux anymore. The uapi header stays.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.bfs
for you to fetch changes up to e36781a626b2708d42a188f6274f1c7897251f1f:
bfs: remove the filesystem (2026-09-04 12:43:07 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.bfs
Please consider pulling these changes from the signed vfs-7.4-rc1.bfs tag.
Thanks!
Christian
----------------------------------------------------------------
Ethan Nelson-Moore (1):
bfs: remove the filesystem
CREDITS | 2 +-
Documentation/filesystems/befs.rst | 4 +-
Documentation/filesystems/bfs.rst | 60 ---
Documentation/filesystems/index.rst | 1 -
MAINTAINERS | 7 -
arch/mips/configs/malta_defconfig | 1 -
arch/mips/configs/malta_kvm_defconfig | 1 -
arch/mips/configs/maltaup_xpa_defconfig | 1 -
arch/mips/configs/rm200_defconfig | 1 -
arch/powerpc/configs/fsl-emb-nonhw.config | 1 -
arch/powerpc/configs/ppc6xx_defconfig | 1 -
fs/Kconfig | 1 -
fs/Makefile | 1 -
fs/bfs/Kconfig | 21 -
fs/bfs/Makefile | 8 -
fs/bfs/bfs.h | 69 ---
fs/bfs/dir.c | 356 --------------
fs/bfs/file.c | 203 --------
fs/bfs/inode.c | 538 ---------------------
.../filesystems/statmount/statmount_test.c | 2 +-
20 files changed, 4 insertions(+), 1275 deletions(-)
delete mode 100644 Documentation/filesystems/bfs.rst
delete mode 100644 fs/bfs/Kconfig
delete mode 100644 fs/bfs/Makefile
delete mode 100644 fs/bfs/bfs.h
delete mode 100644 fs/bfs/dir.c
delete mode 100644 fs/bfs/file.c
delete mode 100644 fs/bfs/inode.c
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 05/19 for v7.4] vfs bh
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (3 preceding siblings ...)
2026-10-16 10:16 ` [GIT PULL 04/19 for v7.4] vfs bfs Christian Brauner
@ 2026-10-16 10:16 ` Christian Brauner
2026-10-16 10:16 ` [GIT PULL 06/19 for v7.4] vfs binfmt Christian Brauner
` (13 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:16 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This stops the buffer_head write completion handlers from clearing
BH_Uptodate when a write fails.
A buffer whose write failed still holds exactly the data the filesystem
asked to be written. It's the disk that is stale, not the buffer.
Claiming otherwise has consequences. mark_buffer_dirty() warns when a
filesystem redirties the buffer to retry the write, a buffer that isn't
up to date gets re-read from disk which silently replaces the data with
the stale on-disk copy, and the window between the write completing and
BH_Uptodate being cleared is visible to anyone holding the folio lock.
BH_Write_EIO already records that the last write failed. Every consumer
is moved over to buffer_write_io_error(): the two core helpers in
fs/buffer.c, adfs, ext2, omfs, exfat, fat, ext4, ocfs2, gfs2 and jbd2.
Then write completion stops touching BH_Uptodate in both directions and
BH_Write_EIO is cleared on successful completion instead of at
submission, so a resubmission no longer hides an error that hasn't been
fixed yet. bforget() and invalidation drop the flag so a reused block
doesn't inherit someone else's write error.
The groundwork for this removes b_page from struct buffer_head and lets
a buffer_head point at memory outside the page cache. jbd2's shadow
buffers sit on a slab folio today. A slab folio overloads ->mapping so
mark_buffer_write_io_error() couldn't be called on them at all. They
now point at the frozen data directly with b_folio NULL.
Also included are documentation updates from Matthew for sb_bread(),
sb_breadahead() and mmb_mark_buffer_dirty() and the removal of stale
references to unmap_buffer() and mark_buffer_dirty_inode().
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
This conflicts with the mm tree in include/linux/buffer_head.h between
commits effd0cf5f5261 ("md: remove the last use of page_buffers()") and
ebb7205efe614 ("md: use folio_alloc_buffers()") from the mm tree and
commits 1aeacc2cbf86e ("buffer_head: Remove b_page") and 3c9ab45852f63
("jbd2: point the shadow buffer at the frozen data directly") from this
tree. The mm tree removes the page_buffers() macro, this tree switches
bh_offset() to b_folio and adds kmap_local_bh() and kunmap_local_bh()
right above it:
diff --cc include/linux/buffer_head.h
index 4b0b7188472b,e7a701ce029d..f8782b719026
--- a/include/linux/buffer_head.h
+++ b/include/linux/buffer_head.h
@@@ -172,10 -169,44 +169,39 @@@ static __always_inline int buffer_uptod
static inline unsigned long bh_offset(const struct buffer_head *bh)
{
- return (unsigned long)(bh)->b_data & (page_size(bh->b_page) - 1);
+ return (unsigned long)(bh)->b_data & (folio_size(bh->b_folio) - 1);
+ }
+
+ /**
+ * kmap_local_bh - Map the data of a buffer.
+ * @bh: The buffer.
+ *
+ * Buffers usually live in the page cache, but a few are built over memory
+ * which is not. Those carry no folio and b_data is already a kernel address
+ * which is always mapped, so there is nothing to do for them. Pair with
+ * kunmap_local_bh().
+ *
+ * Return: A pointer to the buffer's data.
+ */
+ static inline void *kmap_local_bh(const struct buffer_head *bh)
+ {
+ if (!bh->b_folio)
+ return bh->b_data;
+ return kmap_local_folio(bh->b_folio, bh_offset(bh));
+ }
+
+ /**
+ * kunmap_local_bh - Unmap the data of a buffer.
+ * @bh: The buffer.
+ * @addr: The address returned by kmap_local_bh().
+ */
+ static inline void kunmap_local_bh(const struct buffer_head *bh, void *addr)
+ {
+ if (bh->b_folio)
+ kunmap_local(addr);
}
-/* If we *know* page->private refers to buffer_heads */
-#define page_buffers(page) \
- ({ \
- BUG_ON(!PagePrivate(page)); \
- ((struct buffer_head *)page_private(page)); \
- })
+/* If we *know* folio->private refers to buffer_heads */
#define folio_buffers(folio) folio_get_private(folio)
void buffer_check_dirty_writeback(struct folio *folio,
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.bh
for you to fetch changes up to 7c5bb35718a6ecc2001e2f8f6abc068ab926b583:
Merge patch series "Buffer head documentation updates" (2026-09-10 09:27:29 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.bh
Please consider pulling these changes from the signed vfs-7.4-rc1.bh tag.
Thanks!
Christian
----------------------------------------------------------------
Chao Shi (20):
buffer: allow a buffer_head to point at memory outside the page cache
jbd2: point the shadow buffer at the frozen data directly
buffer: read the folio's mapping directly in buffer_set_crypto_ctx()
buffer: clear BH_Write_EIO when a buffer is forgotten
buffer: discard BH_Write_EIO along with the rest of the buffer state
buffer: detect metadata write errors with buffer_write_io_error()
adfs: check for a directory write error with buffer_write_io_error()
ext2: check for an xattr block write error with buffer_write_io_error()
omfs: check for an inode write error with buffer_write_io_error()
exfat: check for a directory write error with buffer_write_io_error()
fat: check for a metadata write error with buffer_write_io_error()
ext4: check for a metadata write error with buffer_write_io_error()
ocfs2: check for a metadata write error with buffer_write_io_error()
ocfs2: check for a stale write error before reusing a metadata buffer
gfs2: check for a metadata write error with buffer_write_io_error()
jbd2: report journal write errors with BH_Write_EIO
jbd2: say what jbd2_freeze_jh_data()'s assertion is actually checking
jbd2: check for a fast commit write error with buffer_write_io_error()
buffer: stop touching BH_Uptodate on write completion
buffer: clear BH_Write_EIO when a write succeeds, not when one starts
Christian Brauner (2):
Merge patch series "buffer: stop clearing BH_Uptodate when a write fails"
Merge patch series "Buffer head documentation updates"
Matthew Wilcox (Oracle) (7):
buffer_head: Remove b_page
buffer: Remove reference to unmap_buffer()
fs: Remove references to mark_buffer_dirty_inode()
buffer: Document sb_bread(), sb_bread_unmovable() and sb_breadahead()
buffer: Document mmb_mark_buffer_dirty()
buffer: Refer to folios in comments
buffer: Rename label
Documentation/filesystems/porting.rst | 2 +-
fs/adfs/dir.c | 2 +-
fs/buffer.c | 131 ++++++++++++++++++----------------
fs/exfat/misc.c | 2 +-
fs/ext2/xattr.c | 2 +-
fs/ext4/ext4_jbd2.c | 2 +-
fs/ext4/mmp.c | 2 +-
fs/fat/misc.c | 2 +-
fs/gfs2/log.c | 4 +-
fs/gfs2/lops.c | 4 +-
fs/jbd2/commit.c | 22 +++---
fs/jbd2/journal.c | 31 ++++----
fs/jbd2/transaction.c | 2 +-
fs/ocfs2/buffer_head_io.c | 12 ++--
fs/ocfs2/journal.c | 25 +++----
fs/omfs/inode.c | 4 +-
include/linux/buffer_head.h | 86 +++++++++++++++++++---
17 files changed, 209 insertions(+), 126 deletions(-)
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 06/19 for v7.4] vfs binfmt
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (4 preceding siblings ...)
2026-10-16 10:16 ` [GIT PULL 05/19 for v7.4] vfs bh Christian Brauner
@ 2026-10-16 10:16 ` Christian Brauner
2026-10-16 10:17 ` [GIT PULL 07/19 for v7.4] vfs close_range Christian Brauner
` (12 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:16 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This only lets punctuation delimit a binfmt_misc register string.
Arbitrary delimiters never made sense and nothing uses them. Every new
flag shrank the set of possible delimiters and made extensions more
hazardous than they need to be. Letters, digits, whitespace, control
characters, bytes above 0x7f and the backslash now get EINVAL.
Everything deployed uses ':' anyway. This extends the fix that rejected
a flag character as the delimiter. Selftests and documentation are
included.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.binfmt
for you to fetch changes up to 87b76786cc04c8137133a360088d94ab2ed592ca:
Merge patch series "binfmt_misc: only let punctuation delimit a register string" (2026-08-31 10:06:36 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.binfmt
Please consider pulling these changes from the signed vfs-7.4-rc1.binfmt tag.
Thanks!
Christian
----------------------------------------------------------------
Christian Brauner (4):
binfmt_misc: only let punctuation delimit a register string
selftests/exec: test delimiter restrictions
binfmt_misc: document the field delimiter
Merge patch series "binfmt_misc: only let punctuation delimit a register string"
Documentation/admin-guide/binfmt-misc.rst | 3 +
fs/binfmt_misc.c | 12 ++-
tools/testing/selftests/exec/Makefile | 4 +
tools/testing/selftests/exec/binfmt_misc_delim.c | 127 +++++++++++++++++++++++
4 files changed, 143 insertions(+), 3 deletions(-)
create mode 100644 tools/testing/selftests/exec/binfmt_misc_delim.c
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 07/19 for v7.4] vfs close_range
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (5 preceding siblings ...)
2026-10-16 10:16 ` [GIT PULL 06/19 for v7.4] vfs binfmt Christian Brauner
@ 2026-10-16 10:17 ` Christian Brauner
2026-10-16 10:18 ` [GIT PULL 08/19 for v7.4] vfs coredump Christian Brauner
` (11 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:17 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This adds two new close_range() flags.
CLOSE_RANGE_EXCEPT makes close_range() operate on all file descriptors
outside of [fd, max_fd] instead of the ones inside. Alone it closes
everything but the range. With CLOSE_RANGE_CLOEXEC it marks everything
but the range close-on-exec. With CLOSE_RANGE_UNSHARE dup_fd() never
takes a reference on what is dropped. So a task between
clone(CLONE_FILES | CLONE_VM | CLONE_VFORK) and execve() that has the
descriptors for the child in one window can shed the rest of the shared
table in one call and nothing outside of the window is referenced by
the child at any point.
CLOSE_RANGE_CLOEXEC_ONLY closes the close-on-exec descriptors in the
range and leaves everything else alone. Whatever the caller
deliberately passes down, stdio, LISTEN_FDS, an inherited pipe, stays
where it is. Combined with CLOSE_RANGE_EXCEPT it names the handful of
close-on-exec descriptors that have to survive, the executable or an
error pipe, and closes every other close-on-exec descriptor.
Along the way dup_fd() stops copying a range in the middle of the table
only to close it again. close_range(CLOSE_RANGE_UNSHARE) only avoided
the copy when the range sat at the end of the table. Descriptors in a
skipped range are never copied and no reference is taken on them, so
->flush() isn't called anymore for files from a table they were never
part of. The flags are turned into an enum and selftests cover the
window positions, the shared and the private table and the unshare
form.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit fd73f4a6659897191fa0d40695fe370925dd3780:
Linux 7.3-rc3 (2026-09-13 14:38:02 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.close_range
for you to fetch changes up to c73c0e243836d5dfd1c617f73b6003b1ad40b2d1:
Merge patch series "files,close_range: add CLOSE_RANGE_{CLOEXEC_ONLY,EXCEPT}" (2026-10-05 13:02:41 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.close_range
Please consider pulling these changes from the signed vfs-7.4-rc1.close_range tag.
Thanks!
Christian
----------------------------------------------------------------
Christian Brauner (11):
file: let dup_fd() leave the punched hole behind
selftests/core: test the hole CLOSE_RANGE_UNSHARE leaves behind
file: rename dup_fd()'s punch_hole to range
file: let dup_fd() drop everything outside of the range
close_range: turn the flags into an enum
file: add CLOSE_RANGE_EXCEPT
selftests/core: test CLOSE_RANGE_EXCEPT
file: let dup_fd() drop only close-on-exec descriptors
file: add CLOSE_RANGE_CLOEXEC_ONLY
selftests/core: test CLOSE_RANGE_CLOEXEC_ONLY
Merge patch series "files,close_range: add CLOSE_RANGE_{CLOEXEC_ONLY,EXCEPT}"
fs/file.c | 200 ++++-
include/linux/fdtable.h | 9 +
include/uapi/linux/close_range.h | 31 +-
tools/testing/selftests/core/close_range_test.c | 951 ++++++++++++++++++++++++
4 files changed, 1151 insertions(+), 40 deletions(-)
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 08/19 for v7.4] vfs coredump
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (6 preceding siblings ...)
2026-10-16 10:17 ` [GIT PULL 07/19 for v7.4] vfs close_range Christian Brauner
@ 2026-10-16 10:18 ` Christian Brauner
2026-10-16 10:18 ` [GIT PULL 09/19 for v7.4] vfs file Christian Brauner
` (10 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:18 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This adds sparse coredumps and per-request memory type selection to the
coredump socket protocol.
A coredump sent over the socket transfers every zero of every hole in
every mapping. For a process with 128 threads that's 1 GB of mostly
thread stacks, 8 MB reservations with a few pages touched, and the
holes sit in the middle of the dump rather than at the end. The
coredump_filter bit that was proposed for this stops each PT_LOAD at
the last populated page. But that mask says which kinds of memory to
include and propagates across fork and exec, whereas what is selected
here is an encoding. The usermodehelper isn't salvagable for this
either. The coredump socket already has a handshake for exactly this.
A server that raises COREDUMP_RECORDS in coredump_ack->mask gets the
coredump as a sequence of records, each a struct coredump_record_header
followed by what it describes. The stream ends explicitly with an end
record that reports the size, so a missing one means truncation. With
COREDUMP_SPARSE holes cross the socket as a bare header that says how
many zero bytes were skipped. Reassembling the records gives back the
same coredump, so a debugger and everything else still see an ordinary
core file. Numbers from the selftests: the 128 thread process sends
1424153 bytes for a coredump of 1075150848 bytes, a 256 MB mapping with
the first and the last page touched sends 188793 bytes for 268890112
bytes, and with COREDUMP_RECORDS alone the record overhead is under one
percent. The selftests also simulate a server uploading to a blob store
that can't seek and rewrites the program headers so the object is an
ordinary ELF core file without the holes.
COREDUMP_MEMORY_TYPES lets the server choose what memory to dump per
request instead of relying on the static /proc/<pid>/coredump_filter
of the crashing task. The request carries the default types and a mask
of every type the kernel knows about, the ack carries the selection.
Zero is valid and dumps the program headers and notes and nothing but
the mappings that are always dumped.
Preparatory cleanups refuse negative skips in dump_skip_to(), chunk
every write at a page so a pipe or a socket never takes a short write
in the middle of a record, make the dump helpers return bool and
replace the core_dumped integer with COREDUMP_STATE_STARTED and
COREDUMP_STATE_TRUNCATED flags.
Also included is a fix for coredump_parse() reading core_pattern while
it is being modified. The sysctl handler now validates a copy and
publishes it under a spinlock and the parser works on a snapshot, so a
rejected pattern is never visible and the rollback logic goes away.
And to_kthread()'s lockless flags read is annotated with READ_ONCE().
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
This conflicts with the kernel-7.4-rc1.signal tag in
tools/testing/selftests/coredump/coredump_test.h and
tools/testing/selftests/coredump/coredump_test_helpers.c between commit
7ac8d57a436c8 ("selftests/coredump: test that TIF_NOTIFY_SIGNAL doesn't
truncate a coredump") from that tag and commit eec8727ba2730
("selftests/coredump: add a separate helper header") from this tag. The
signal tag is merged before this one. The signal tag adds the
coredump_notify_signal.h and sys/syscall.h includes and this tag moves
everything else the two files shared into coredump_test_helpers.h:
diff --cc tools/testing/selftests/coredump/coredump_test.h
index 06f997ba47fd,8d99b5cb2f12..000000000000
--- a/tools/testing/selftests/coredump/coredump_test.h
+++ b/tools/testing/selftests/coredump/coredump_test.h
@@@ -3,19 -3,9 +3,10 @@@
#ifndef __COREDUMP_TEST_H
#define __COREDUMP_TEST_H
- #include <stdbool.h>
- #include <sys/types.h>
- #include <linux/coredump.h>
-
#include "../kselftest_harness.h"
- #include "../pidfd/pidfd.h"
+#include "coredump_notify_signal.h"
- #ifndef PAGE_SIZE
- #define PAGE_SIZE 4096
- #endif
-
- #define NUM_THREAD_SPAWN 128
+ #include "coredump_test_helpers.h"
/* Coredump fixture */
FIXTURE(coredump)
diff --cc tools/testing/selftests/coredump/coredump_test_helpers.c
index f8d416180d5b,4e36e3e4fb78..000000000000
--- a/tools/testing/selftests/coredump/coredump_test_helpers.c
+++ b/tools/testing/selftests/coredump/coredump_test_helpers.c
@@@ -22,32 -17,22 +22,24 @@@
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/socket.h>
+ #include <sys/stat.h>
+#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/un.h>
#include <sys/wait.h>
#include <unistd.h>
#include "../filesystems/wrappers.h"
- #include "../pidfd/pidfd.h"
+#include "coredump_notify_signal.h"
- /* Forward declarations to avoid including harness header */
- struct __test_metadata;
+ #include "coredump_test_helpers.h"
- /* Match the fixture definition from coredump_test.h */
- struct _fixture_coredump_data {
- char original_core_pattern[256];
- pid_t pid_coredump_server;
- int fd_tmpfs_detached;
- };
-
- #ifndef PAGE_SIZE
- #define PAGE_SIZE 4096
+ #if __ELF_NATIVE_CLASS == 64
+ #define COREDUMP_ELFCLASS ELFCLASS64
+ #else
+ #define COREDUMP_ELFCLASS ELFCLASS32
#endif
- #define NUM_THREAD_SPAWN 128
-
void *do_nothing(void *arg)
{
(void)arg;
Merge conflicts with other trees
================================
This conflicts with the mm tree in fs/coredump.c between commit
e2f895dd2f8cb ("mm: rename is_vm_hugetlb_page() to vma_is_hugetlb()")
from the mm tree and commit 757ebc30a3725 ("coredump: select memory
types to include") from this tree:
diff --cc fs/coredump.c
index 5820cb8ec88e,357f0774d5a1..5b657770f154
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@@ -1608,10 -1850,12 +1850,12 @@@ static unsigned long vma_dump_size(stru
}
/* Hugetlb memory check */
- if (is_vm_hugetlb_page(vma)) {
+ if (vma_is_hugetlb(vma)) {
- if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED))
+ if ((vma->vm_flags & VM_SHARED) &&
+ COREDUMP_MEMORY_TYPE_INCLUDE(memory_types, HUGETLB_SHARED))
goto whole;
- if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
+ if (!(vma->vm_flags & VM_SHARED) &&
+ COREDUMP_MEMORY_TYPE_INCLUDE(memory_types, HUGETLB_PRIVATE))
goto whole;
return 0;
}
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.coredump
for you to fetch changes up to fd00a46e36a12c5279d3d163f0d0c8f83d12dc09:
kthread: Annotate lockless to_kthread() flags access (2026-09-25 11:33:50 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.coredump
Please consider pulling these changes from the signed vfs-7.4-rc1.coredump tag.
Thanks!
Christian
----------------------------------------------------------------
Christian Brauner (30):
coredump: refuse negative skips
coredump: set the minimum send buffer size
selftests/coredump: discard the right amount after the coredump request
selftests/coredump: collapse the expected request check into the helper
selftests/coredump: add a separate helper header
coredump: pin the protocol struct sizes
coredump: move the negotiated mask into struct coredump_params
coredump: deduplicate the to_skip flush
coredump: make the dump helper return bool
coredump: always chunk writes
coredump: clean up coredump state handling
coredump: add COREDUMP_RECORDS to the coredump socket protocol
coredump: add COREDUMP_SPARSE to the coredump socket protocol
tools: sync coredump.h header
coredump: send the coredump in records if requested
coredump: describe the holes when COREDUMP_SPARSE is negotiated
selftests/coredump: test COREDUMP_RECORDS and COREDUMP_SPARSE
selftests/coredump: hand the record stream to a sink
selftests/coredump: put a hole in the middle of a sparse mapping
selftests/coredump: simulate a blob store
selftests/coredump: show how to inspect the task to decide how the coredump should be sent
Merge patch series "coredump: allow to create sparse coredumps on the coredump socket"
coredump: select memory types to include
tools: sync coredump.h header
selftests/coredump: simplify the refusal tests
selftests/coredump: test COREDUMP_MEMORY_TYPES
selftests/coredump: improve coredump size negotiation tests
selftests/coredump: test failed handshakes
Merge patch series "coredump: select memory types per request"
coredump: parse a snapshot of core_pattern
Kunwu Chan (1):
kthread: Annotate lockless to_kthread() flags access
Documentation/filesystems/proc.rst | 4 +
fs/binfmt_elf.c | 12 +-
fs/binfmt_elf_fdpic.c | 12 +-
fs/coredump.c | 490 ++++--
include/linux/binfmts.h | 3 +-
include/linux/coredump.h | 37 +-
include/uapi/linux/coredump.h | 149 +-
kernel/kthread.c | 2 +-
tools/include/uapi/linux/coredump.h | 149 +-
.../coredump/coredump_socket_protocol_test.c | 1829 +++++++++++++++-----
tools/testing/selftests/coredump/coredump_test.h | 31 +-
.../selftests/coredump/coredump_test_helpers.c | 1432 ++++++++++++++-
.../selftests/coredump/coredump_test_helpers.h | 79 +
13 files changed, 3597 insertions(+), 632 deletions(-)
create mode 100644 tools/testing/selftests/coredump/coredump_test_helpers.h
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 09/19 for v7.4] vfs file
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (7 preceding siblings ...)
2026-10-16 10:18 ` [GIT PULL 08/19 for v7.4] vfs coredump Christian Brauner
@ 2026-10-16 10:18 ` Christian Brauner
2026-10-16 10:19 ` [GIT PULL 10/19 for v7.4] vfs idmap Christian Brauner
` (9 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:18 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This annotates struct fdtable's fd array with __counted_by_ptr so KASAN
and the fortified functions can bounds check it against max_fds and
adds a KUnit suite for fdtable. A follow-up uses __struct_size() in the
test since sparse doesn't know __builtin_dynamic_object_size().
FD_PREPARE() is simplified. It was built as an ACQUIRE-style guard on
infrastructure that was never needed. The ACQUIRE machinery and
CLASS_INIT() go away, the variable is declared with __cleanup()
directly, struct fd_prepare loses its err field since the fd either
holds the descriptor or the error, and callers get a const pointer to
the guard behind a UNIQUE_ID() name so they can't shadow it. Code
generation is identical.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
This conflicts with mainline in fs/namespace.c between commit
7253a6ff640df ("namespace: drop the file's reference first in
dissolve_on_fput()") in mainline and commit 64cbb36448ff2 ("file: make
struct fd_prepare const and kill its err field") from this tree:
diff --cc fs/namespace.c
index 59fb227df39f,0f5c00816775..000000000000
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@@ -4701,9 -4544,9 +4701,9 @@@ SYSCALL_DEFINE3(fsmount, int, fs_fd, un
FD_PREPARE(fdf, (flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0,
dentry_open(&new_path, O_PATH, fc->cred));
- if (fdf.err) {
+ if (fdf->fd < 0) {
- dissolve_on_fput(new_path.mnt);
+ dissolve_on_fput(no_free_ptr(new_path.mnt));
- return fdf.err;
+ return fdf->fd;
}
/*
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.file
for you to fetch changes up to fae37d5e3c4e94aef334825ab89f66efcfe489b2:
Merge patch series "file: simplify and harden cleanup handling" (2026-09-23 09:28:02 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.file
Please consider pulling these changes from the signed vfs-7.4-rc1.file tag.
Thanks!
Christian
----------------------------------------------------------------
Bill Wendling (2):
vfs: Annotate struct fdtable's fd field with __counted_by_ptr
vfs: Add KUnit tests for fdtable
Christian Brauner (7):
Merge patch series "vfs: Annotate struct fdtable's fd field with __counted_by_ptr"
vfs: use __struct_size() in the fdtable KUnit test
file: simplify FD_PREPARE()
file: declare the FD_PREPARE() variable with __cleanup() directly
cleanup: remove CLASS_INIT()
file: make struct fd_prepare const and kill its err field
Merge patch series "file: simplify and harden cleanup handling"
arch/powerpc/platforms/cell/spufs/inode.c | 12 +--
drivers/gpio/gpiolib-cdev.c | 18 ++---
drivers/gpu/drm/msm/msm_perfcntr.c | 4 +-
drivers/media/mc/mc-request.c | 8 +-
drivers/misc/ntsync.c | 6 +-
fs/Kconfig | 8 ++
fs/eventfd.c | 4 +-
fs/eventpoll.c | 6 +-
fs/file.c | 12 ++-
fs/namespace.c | 12 +--
fs/nsfs.c | 4 +-
fs/tests/.kunitconfig | 2 +
fs/tests/fdtable_kunit.c | 72 +++++++++++++++++
fs/xfs/xfs_handle.c | 6 +-
include/linux/cleanup.h | 7 --
include/linux/fdtable.h | 2 +-
include/linux/file.h | 130 +++++++++++-------------------
io_uring/mock_file.c | 8 +-
kernel/bpf/bpf_iter.c | 6 +-
kernel/bpf/token.c | 6 +-
mm/userfaultfd.c | 6 +-
net/core/scm.c | 8 +-
net/handshake/netlink.c | 8 +-
net/kcm/kcmsock.c | 6 +-
24 files changed, 204 insertions(+), 157 deletions(-)
create mode 100644 fs/tests/.kunitconfig
create mode 100644 fs/tests/fdtable_kunit.c
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 10/19 for v7.4] vfs idmap
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (8 preceding siblings ...)
2026-10-16 10:18 ` [GIT PULL 09/19 for v7.4] vfs file Christian Brauner
@ 2026-10-16 10:19 ` Christian Brauner
2026-10-16 10:21 ` [GIT PULL 11/19 for v7.4] vfs iomap Christian Brauner
` (8 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:19 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This makes struct mnt_idmap const throughout the tree. This will have a
bunch of merge conflicts. We can also just agree to send this right
before -rc1 is cut. Alternatively an LLM should do a fine job of fixing
these mechanical conversions.
A mount's idmapping is immutable. The only thing modified after
alloc_mnt_idmap() is the reference count and that is hidden behind
mnt_idmap_get() and mnt_idmap_put(). Everything else only reads from
it. That is the same model struct cred uses and the idmapping is
sensitive enough to deserve it. The conversion goes bottom up through
the vfs{g,u}id and fs{g,u}id helpers, the privilege checks, acl, xattr
and quota and then every inode operation that takes an idmap, so
->permission(), ->getattr(), ->setattr(), ->create(), ->mkdir(),
->mknod(), ->symlink(), ->rename(), ->tmpfile(), ->get_acl(),
->set_acl() and ->fileattr_set() with their implementations in every
filesystem, plus the LSM hooks. struct vfsmount, struct mount_kattr
and struct kstatmount store a const pointer and nop_mnt_idmap and
invalid_mnt_idmap live in rodata, so anything that tries to modify
them faults instead of silently corrupting the initial idmapping.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
This conflicts with mainline in fs/smb/server/smbacl.c between commits
c61dc7b1b4a32 ("ksmbd: propagate DACL parsing errors") and
feca5e70fc963 ("ksmbd: rate limit unmapped SID errors") in mainline and
commit 1923c1065fe94 ("fs: port vfs{g,u}id helpers to const mnt_idmap")
from this tree. parse_dacl() returns an int now and takes a const
idmap:
diff --cc fs/smb/server/smbacl.c
index 1fad6ccf3a72,784067d14f56..000000000000
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@@ -383,10 -383,10 +383,10 @@@ void free_acl_state(struct posix_acl_st
kfree(state->groups);
}
- static int parse_dacl(struct mnt_idmap *idmap,
-static void parse_dacl(const struct mnt_idmap *idmap,
- struct smb_acl *pdacl, char *end_of_acl,
- struct smb_sid *pownersid, struct smb_sid *pgrpsid,
- struct smb_fattr *fattr)
++static int parse_dacl(const struct mnt_idmap *idmap,
+ struct smb_acl *pdacl, char *end_of_acl,
+ struct smb_sid *pownersid, struct smb_sid *pgrpsid,
+ struct smb_fattr *fattr)
{
int i, ret;
u16 num_aces = 0;
@@@ -603,23 -598,17 +603,23 @@@
fattr->cf_dacls =
posix_acl_alloc(default_acl_state.users->n +
default_acl_state.groups->n + 4, KSMBD_DEFAULT_GFP);
- if (fattr->cf_dacls) {
- cf_pdace = fattr->cf_dacls->a_entries;
- posix_state_to_acl(&default_acl_state, cf_pdace);
+ if (!fattr->cf_dacls) {
+ ret = -ENOMEM;
+ goto out;
}
+ cf_pdace = fattr->cf_dacls->a_entries;
+ posix_state_to_acl(&default_acl_state, cf_pdace);
}
}
+ ret = 0;
+out:
+ kfree(ppace);
free_acl_state(&acl_state);
free_acl_state(&default_acl_state);
+ return ret;
}
- static void set_posix_acl_entries_dacl(struct mnt_idmap *idmap,
+ static void set_posix_acl_entries_dacl(const struct mnt_idmap *idmap,
struct smb_ace *pndace,
struct smb_fattr *fattr, u16 *num_aces,
u16 *size, u16 existing_nt_aces,
It also conflicts with the vfs-7.4-rc1.bfs tag in fs/bfs/dir.c. Commit
e36781a626b27 ("bfs: remove the filesystem") from that tag deletes the
file and commits eb50cbe14ff97 ("fs: port ->create() to pass const
mnt_idmap") and 8ee61322bb530 ("fs: port ->rename() to pass const
mnt_idmap") from this tree modify it. The bfs tag is merged before this
one. The file stays deleted.
And it conflicts with mainline in fs/nullfs.c without git noticing.
Commit 54867884fef50 ("nullfs: add an empty immutable regular file") in
mainline adds nullfs_file_setattr() with the old signature and commit
e2f0d6d4569d1 ("fs: port ->setattr() to pass const mnt_idmap") from
this tree changes the prototype. So the merge fails to build with
-Werror=incompatible-pointer-types and needs this on top:
diff --git a/fs/nullfs.c b/fs/nullfs.c
index e7221bc8aedb..f79cc03214dd 100644
--- a/fs/nullfs.c
+++ b/fs/nullfs.c
@@ -74,8 +74,8 @@ static ssize_t nullfs_file_splice_write(struct pipe_inode_info *pipe,
return splice_from_pipe(pipe, out, ppos, len, flags, nullfs_pipe_to_null);
}
-static int nullfs_file_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
- struct iattr *attr)
+static int nullfs_file_setattr(const struct mnt_idmap *idmap,
+ struct dentry *dentry, struct iattr *attr)
{
if (attr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID))
return -EPERM;
Merge conflicts with other trees
================================
The treewide const conversion conflicts with every tree that added or
changed a function taking a struct mnt_idmap this cycle. All of them
resolve the same way, by taking both sides and making the idmap
parameter const. In linux-next that is:
- the f2fs tree in fs/f2fs/acl.c and fs/f2fs/acl.h between commit
493b9dc8b52ca ("f2fs: cache: use node cache") from the f2fs tree and
commit 737362c7012af ("fs: port ->set_acl() to pass const mnt_idmap")
from this tree
- the gfs2 tree in fs/gfs2/inode.c between commit d0c4bce31a579 ("gfs2:
gfs2_create_inode excl cleanup") from the gfs2 tree and commit
7d0db72041b74 ("fs: port ->mknod() to pass const mnt_idmap") from
this tree
- the nfs tree in fs/nfs/internal.h between commit 8c955dacf45f8 ("nfs:
set gencount on protocol-specific remove") from the nfs tree and
commits eb50cbe14ff97 ("fs: port ->create() to pass const mnt_idmap")
and 566707035a6e0 ("fs: port ->mkdir() to pass const mnt_idmap") from
this tree
- the ntfs3 tree in fs/ntfs3/namei.c between commit 8f4736fe2f22a
("fs/ntfs3: minor code cleanups") from the ntfs3 tree and commit
566707035a6e0 ("fs: port ->mkdir() to pass const mnt_idmap") from
this tree
- the cifs tree in fs/smb/client/cifsfs.h and fs/smb/client/ioctl.c.
Commit 273913b7c33a5 ("smb: client: implement fileattr_set for
compression flags") from the cifs tree adds cifs_fileattr_set() which
needs the const idmap from commit 51e7cfbd10512 ("fs: port
->fileattr_set() to pass const mnt_idmap") from this tree. The ioctl.c
part isn't a textual conflict, it just doesn't build.
- the ksmbd tree in fs/smb/server/smb2pdu.c, fs/smb/server/vfs.c and
fs/smb/server/vfs.h. The named stream work there, commits
9a4c5d1700381 ("ksmbd: look up stream size by exact xattr name"),
387223916152f ("ksmbd: fix named stream write and EOF handling") and
26a14db500b82 ("ksmbd: copy stream content when renaming to a new
stream name"), adds ksmbd_vfs_xattr_len() and ksmbd_vfs_getcasexattr()
which need the const idmap as well, and commit 2d6831c7d49aa ("ksmbd:
fix invalid pointer dereference when get_inode_acl() fails") changes
ksmbd_acls_fattr() which this tree converts in commit 0c18a70900eee
("fs: port i_{g,u}id_into_vfs{g,u}id() to const mnt_idmap").
- the ntfs tree in fs/ntfs/file.c, fs/ntfs/ntfs.h, fs/ntfs/stream.h and
fs/ntfs/named_stream.c. Commit 057b2ccd118b1 ("ntfs: persist immutable
in the $LINUXFLAGS EA") adds ntfs_fileattr_set() and commits
503fc45f06b42 ("ntfs: add pathname access for named streams") and
fc4f170aa1f10 ("ntfs: add named stream ioctls support") add
ntfs_create_named_stream() and the stream inode operations. None of
that is a textual conflict either, the new code just has to take a
const struct mnt_idmap to build.
- the lsm tree in include/linux/lsm_hook_defs.h,
include/linux/security.h, security/security.c,
security/selinux/hooks.c and security/smack/smack_lsm.c. Commit
16959c469f232 ("lsm: expose mount idmaps to inode hooks") from the lsm
tree adds an idmap argument to the inode_create, inode_link,
inode_symlink, inode_mkdir, inode_mknod and inode_permission hooks
right next to the hooks this tree converts. The new arguments have to
be const as well. The lsm_hook_defs.h part looks like this and the
rest follows from it:
diff --cc include/linux/lsm_hook_defs.h
index c9561564585e,af9624c30f99..ef16e5343e09
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@@ -121,29 -120,30 +121,30 @@@ LSM_HOOK(int, -EOPNOTSUPP, inode_init_s
int *xattr_count)
LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,
const struct qstr *name, const struct inode *context_inode)
- LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
- umode_t mode)
-LSM_HOOK(int, 0, inode_create, struct mnt_idmap *idmap, struct inode *dir,
++LSM_HOOK(int, 0, inode_create, const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode)
-LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap *idmap,
+LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, const struct mnt_idmap *idmap,
struct inode *inode)
- LSM_HOOK(int, 0, inode_link, struct dentry *old_dentry, struct inode *dir,
- struct dentry *new_dentry)
-LSM_HOOK(int, 0, inode_link, struct mnt_idmap *idmap,
++LSM_HOOK(int, 0, inode_link, const struct mnt_idmap *idmap,
+ struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
LSM_HOOK(int, 0, inode_unlink, struct inode *dir, struct dentry *dentry)
- LSM_HOOK(int, 0, inode_symlink, struct inode *dir, struct dentry *dentry,
- const char *old_name)
- LSM_HOOK(int, 0, inode_mkdir, struct inode *dir, struct dentry *dentry,
- umode_t mode)
-LSM_HOOK(int, 0, inode_symlink, struct mnt_idmap *idmap, struct inode *dir,
++LSM_HOOK(int, 0, inode_symlink, const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, const char *old_name)
-LSM_HOOK(int, 0, inode_mkdir, struct mnt_idmap *idmap, struct inode *dir,
++LSM_HOOK(int, 0, inode_mkdir, const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode)
LSM_HOOK(int, 0, inode_rmdir, struct inode *dir, struct dentry *dentry)
- LSM_HOOK(int, 0, inode_mknod, struct inode *dir, struct dentry *dentry,
- umode_t mode, dev_t dev)
-LSM_HOOK(int, 0, inode_mknod, struct mnt_idmap *idmap, struct inode *dir,
++LSM_HOOK(int, 0, inode_mknod, const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode, dev_t dev)
LSM_HOOK(int, 0, inode_rename, struct inode *old_dir, struct dentry *old_dentry,
struct inode *new_dir, struct dentry *new_dentry)
LSM_HOOK(int, 0, inode_readlink, struct dentry *dentry)
LSM_HOOK(int, 0, inode_follow_link, struct dentry *dentry, struct inode *inode,
bool rcu)
- LSM_HOOK(int, 0, inode_permission, struct inode *inode, int mask)
-LSM_HOOK(int, 0, inode_permission, struct mnt_idmap *idmap,
++LSM_HOOK(int, 0, inode_permission, const struct mnt_idmap *idmap,
+ struct inode *inode, int mask)
-LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap *idmap, struct dentry *dentry,
+LSM_HOOK(int, 0, inode_setattr, const struct mnt_idmap *idmap, struct dentry *dentry,
struct iattr *attr)
-LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap *idmap,
+LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, const struct mnt_idmap *idmap,
struct dentry *dentry, int ia_valid)
LSM_HOOK(int, 0, inode_getattr, const struct path *path)
LSM_HOOK(int, 0, inode_xattr_skipcap, const char *name)
@@@ -188,7 -188,7 +189,7 @@@ LSM_HOOK(int, 0, inode_setintegrity, co
enum lsm_integrity_type type, const void *value, size_t size)
LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir,
struct kernfs_node *kn)
--LSM_HOOK(int, 0, file_permission, struct file *file, int mask)
++LSM_HOOK(int, 0, file_permission, const struct file *file, int mask)
LSM_HOOK(int, 0, file_alloc_security, struct file *file)
LSM_HOOK(void, LSM_RET_VOID, file_release, struct file *file)
LSM_HOOK(void, LSM_RET_VOID, file_free_security, struct file *file)
The short resolutions for f2fs, gfs2, nfs, ntfs3, cifs and ksmbd:
diff --cc fs/f2fs/acl.c
index 34c9aa279040,22ca39e0aad6..a7485bc38252
--- a/fs/f2fs/acl.c
+++ b/fs/f2fs/acl.c
@@@ -240,9 -240,9 +240,9 @@@ static int f2fs_acl_update_mode(const s
return 0;
}
- static int __f2fs_set_acl(struct mnt_idmap *idmap,
+ static int __f2fs_set_acl(const struct mnt_idmap *idmap,
struct inode *inode, int type,
- struct posix_acl *acl, struct folio *ifolio)
+ struct posix_acl *acl, struct f2fs_cached_block *ientry)
{
int name_index;
void *value = NULL;
diff --cc fs/f2fs/acl.h
index 0f639367a0ab,01ec74b6daf2..b1085efcc05e
--- a/fs/f2fs/acl.h
+++ b/fs/f2fs/acl.h
@@@ -34,11 -34,10 +34,11 @@@ struct f2fs_acl_header
#ifdef CONFIG_F2FS_FS_POSIX_ACL
struct posix_acl *f2fs_get_acl(struct inode *, int, bool);
- int f2fs_set_acl(struct mnt_idmap *, struct dentry *,
+ int f2fs_set_acl(const struct mnt_idmap *, struct dentry *,
struct posix_acl *, int);
-int f2fs_init_acl(struct inode *, struct inode *, struct folio *ifolio,
- struct folio *dfolio);
+int f2fs_init_acl(struct inode *inode, struct inode *dir,
+ struct f2fs_cached_block *ientry,
+ struct f2fs_cached_block *dentry);
#else
#define f2fs_get_acl NULL
#define f2fs_set_acl NULL
diff --cc fs/gfs2/inode.c
index f748f8b3c73a,a040da86d8ed..2c2dc459c037
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@@ -1369,10 -1363,10 +1369,10 @@@ static struct dentry *gfs2_mkdir(const
*
*/
- static int gfs2_mknod(struct mnt_idmap *idmap, struct inode *dir,
+ static int gfs2_mknod(const struct mnt_idmap *idmap, struct inode *dir,
struct dentry *dentry, umode_t mode, dev_t dev)
{
- return gfs2_create_inode(dir, dentry, NULL, mode, dev, NULL, 0, 0);
+ return gfs2_create_inode(dir, dentry, NULL, mode, dev, NULL, 0, 1);
}
/**
diff --cc fs/nfs/internal.h
index 42f170973000,cbb323c6530d..13c4ed360d62
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@@ -395,12 -394,11 +395,12 @@@ extern unsigned long nfs_access_cache_c
struct shrink_control *sc);
extern unsigned long nfs_access_cache_scan(struct shrinker *shrink,
struct shrink_control *sc);
+extern void nfs_drop_nlink(struct inode *inode, unsigned long gencount);
struct dentry *nfs_lookup(struct inode *, struct dentry *, unsigned int);
void nfs_d_prune_case_insensitive_aliases(struct inode *inode);
- int nfs_create(struct mnt_idmap *, struct inode *, struct dentry *,
+ int nfs_create(const struct mnt_idmap *, struct inode *, struct dentry *,
umode_t);
- struct dentry *nfs_mkdir(struct mnt_idmap *, struct inode *, struct dentry *,
+ struct dentry *nfs_mkdir(const struct mnt_idmap *, struct inode *, struct dentry *,
umode_t);
int nfs_rmdir(struct inode *, struct dentry *);
int nfs_unlink(struct inode *, struct dentry *);
diff --cc fs/ntfs3/namei.c
index 46923fff0865,ae88cb66fb7e..eefffc0e3245
--- a/fs/ntfs3/namei.c
+++ b/fs/ntfs3/namei.c
@@@ -228,11 -228,11 +228,11 @@@ static int ntfs_symlink(const struct mn
/*
* ntfs_mkdir - inode_operations::mkdir
*/
- static struct dentry *ntfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
+ static struct dentry *ntfs_mkdir(const struct mnt_idmap *idmap, struct inode *dir,
struct dentry *dentry, umode_t mode)
{
- return ERR_PTR(ntfs_create_inode(idmap, dir, dentry, NULL,
- mode, 0, NULL, 0, NULL));
+ return ERR_PTR(ntfs_create_inode(idmap, dir, dentry, NULL, mode, 0,
+ NULL, 0, NULL));
}
/*
diff --cc fs/smb/client/cifsfs.h
index 3c96521513cb,eb9cb1ecb1b5..e54d3798eb2f
--- a/fs/smb/client/cifsfs.h
+++ b/fs/smb/client/cifsfs.h
@@@ -91,8 -91,6 +91,8 @@@ extern const struct inode_operations ci
struct file_kattr;
int cifs_fileattr_get(struct dentry *dentry, struct file_kattr *fa);
- int cifs_fileattr_set(struct mnt_idmap *idmap, struct dentry *dentry,
++int cifs_fileattr_set(const struct mnt_idmap *idmap, struct dentry *dentry,
+ struct file_kattr *fa);
/* Functions related to files and directories */
diff --cc fs/smb/server/smb2pdu.c
index 2da6163ee776,18602a4759c0..b57942263e13
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@@ -3669,11 -3647,10 +3669,11 @@@ static int smb2_create_sd_buffer(struc
le32_to_cpu(sd_buf->ccontext.DataLength), true, false);
}
-static void ksmbd_acls_fattr(struct smb_fattr *fattr,
- const struct mnt_idmap *idmap,
- struct inode *inode)
+static int ksmbd_acls_fattr(struct smb_fattr *fattr,
- struct mnt_idmap *idmap,
++ const struct mnt_idmap *idmap,
+ struct inode *inode)
{
+ struct posix_acl *acl;
vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode);
vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode);
diff --cc fs/smb/server/vfs.h
index dedb10331657,67cc48e583c8..21b0d29a3db0
--- a/fs/smb/server/vfs.h
+++ b/fs/smb/server/vfs.h
@@@ -109,15 -108,10 +109,15 @@@ ssize_t ksmbd_vfs_getxattr(const struc
struct dentry *dentry,
char *xattr_name,
char **xattr_buf);
- ssize_t ksmbd_vfs_xattr_len(struct mnt_idmap *idmap,
++ssize_t ksmbd_vfs_xattr_len(const struct mnt_idmap *idmap,
+ struct dentry *dentry, char *xattr_name);
- ssize_t ksmbd_vfs_getcasexattr(struct mnt_idmap *idmap,
++ssize_t ksmbd_vfs_getcasexattr(const struct mnt_idmap *idmap,
+ struct dentry *dentry, char *attr_name,
+ int attr_name_len, char **attr_value);
- ssize_t ksmbd_vfs_casexattr_len(struct mnt_idmap *idmap,
+ ssize_t ksmbd_vfs_casexattr_len(const struct mnt_idmap *idmap,
struct dentry *dentry, char *attr_name,
- int attr_name_len);
+ int attr_name_len, char *actual_name);
- int ksmbd_vfs_setxattr(struct mnt_idmap *idmap,
+ int ksmbd_vfs_setxattr(const struct mnt_idmap *idmap,
const struct path *path, const char *attr_name,
void *attr_value, size_t attr_size, int flags,
bool get_write);
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.idmap
for you to fetch changes up to 0f30047dc83fe18fe0b0766134e9c1a67a09a431:
Merge patch series "fs: port to const struct mnt_idmap" (2026-09-23 09:20:23 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.idmap
Please consider pulling these changes from the signed vfs-7.4-rc1.idmap tag.
Thanks!
Christian
----------------------------------------------------------------
Christian Brauner (28):
userns: pass const uid_gid_map in lookup helpers
fs: port mnt_idmap_{get,put}() to const mnt_idmap
fs: port vfs{g,u}id helpers to const mnt_idmap
fs: port fs{g,u}id helpers to const mnt_idmap
fs: port i_{g,u}id_into_vfs{g,u}id() to const mnt_idmap
fs: port i_{g,u}id_{needs_}update() to const mnt_idmap
quota: port to const mnt_idmap
fs: port privilege checking helpers to const mnt_idmap
fs: port inode_owner_or_capable() to const mnt_idmap
fs: port inode_init_owner() to const mnt_idmap
fs: port acl to const mnt_idmap
fs: port ->permission() to pass const mnt_idmap
fs: port xattr to const mnt_idmap
fs: port ->fileattr_set() to pass const mnt_idmap
fs: port ->set_acl() to pass const mnt_idmap
fs: port ->get_acl() to pass const mnt_idmap
fs: port ->tmpfile() to pass const mnt_idmap
fs: port ->mknod() to pass const mnt_idmap
fs: port ->rename() to pass const mnt_idmap
fs: port ->mkdir() to pass const mnt_idmap
fs: port ->symlink() to pass const mnt_idmap
fs: port ->create() to pass const mnt_idmap
fs: port ->getattr() to pass const mnt_idmap
fs: port ->setattr() to pass const mnt_idmap
fs: port vfs_*() helpers to const mnt_idmap
fs: port mnt_idmap() and file_mnt_idmap() to const mnt_idmap
fs: make nop_mnt_idmap and invalid_mnt_idmap const
Merge patch series "fs: port to const struct mnt_idmap"
Documentation/filesystems/locking.rst | 24 +++----
Documentation/filesystems/porting.rst | 13 ++++
Documentation/filesystems/vfs.rst | 24 +++----
arch/powerpc/platforms/cell/spufs/inode.c | 2 +-
drivers/android/binder/rust_binderfs.c | 2 +-
drivers/android/binderfs.c | 2 +-
fs/9p/acl.c | 4 +-
fs/9p/acl.h | 4 +-
fs/9p/v9fs.h | 2 +-
fs/9p/v9fs_vfs.h | 2 +-
fs/9p/vfs_inode.c | 14 ++--
fs/9p/vfs_inode_dotl.c | 14 ++--
fs/9p/xattr.c | 2 +-
fs/adfs/adfs.h | 2 +-
fs/adfs/inode.c | 2 +-
fs/affs/affs.h | 10 +--
fs/affs/inode.c | 2 +-
fs/affs/namei.c | 8 +--
fs/afs/dir.c | 16 ++---
fs/afs/inode.c | 4 +-
fs/afs/internal.h | 6 +-
fs/afs/security.c | 2 +-
fs/afs/xattr.c | 4 +-
fs/anon_inodes.c | 4 +-
fs/attr.c | 16 ++---
fs/autofs/root.c | 12 ++--
fs/backing-file.c | 2 +-
fs/bad_inode.c | 20 +++---
fs/bfs/dir.c | 4 +-
fs/btrfs/acl.c | 2 +-
fs/btrfs/acl.h | 2 +-
fs/btrfs/btrfs_inode.h | 2 +-
fs/btrfs/inode.c | 24 +++----
fs/btrfs/ioctl.c | 16 ++---
fs/btrfs/ioctl.h | 2 +-
fs/btrfs/xattr.c | 6 +-
fs/ceph/acl.c | 2 +-
fs/ceph/dir.c | 10 +--
fs/ceph/file.c | 2 +-
fs/ceph/inode.c | 10 +--
fs/ceph/mds_client.h | 2 +-
fs/ceph/super.h | 10 +--
fs/ceph/xattr.c | 2 +-
fs/coda/coda_linux.h | 6 +-
fs/coda/dir.c | 10 +--
fs/coda/inode.c | 4 +-
fs/coda/pioctl.c | 4 +-
fs/configfs/configfs_internal.h | 4 +-
fs/configfs/dir.c | 2 +-
fs/configfs/inode.c | 2 +-
fs/configfs/symlink.c | 2 +-
fs/coredump.c | 2 +-
fs/debugfs/inode.c | 2 +-
fs/ecryptfs/inode.c | 26 +++----
fs/efivarfs/inode.c | 6 +-
fs/erofs/inode.c | 2 +-
fs/erofs/internal.h | 2 +-
fs/exec.c | 4 +-
fs/exfat/exfat_fs.h | 4 +-
fs/exfat/file.c | 6 +-
fs/exfat/namei.c | 6 +-
fs/ext2/acl.c | 2 +-
fs/ext2/acl.h | 2 +-
fs/ext2/ext2.h | 6 +-
fs/ext2/inode.c | 4 +-
fs/ext2/ioctl.c | 2 +-
fs/ext2/namei.c | 12 ++--
fs/ext2/xattr_security.c | 2 +-
fs/ext2/xattr_trusted.c | 2 +-
fs/ext2/xattr_user.c | 2 +-
fs/ext4/acl.c | 2 +-
fs/ext4/acl.h | 2 +-
fs/ext4/ext4.h | 10 +--
fs/ext4/ialloc.c | 2 +-
fs/ext4/inode.c | 6 +-
fs/ext4/ioctl.c | 6 +-
fs/ext4/namei.c | 16 ++---
fs/ext4/symlink.c | 2 +-
fs/ext4/xattr_hurd.c | 2 +-
fs/ext4/xattr_security.c | 2 +-
fs/ext4/xattr_trusted.c | 2 +-
fs/ext4/xattr_user.c | 2 +-
fs/f2fs/acl.c | 6 +-
fs/f2fs/acl.h | 2 +-
fs/f2fs/f2fs.h | 8 +--
fs/f2fs/file.c | 14 ++--
fs/f2fs/namei.c | 24 +++----
fs/f2fs/xattr.c | 4 +-
fs/failfs.c | 4 +-
fs/fat/fat.h | 4 +-
fs/fat/file.c | 6 +-
fs/fat/namei_msdos.c | 6 +-
fs/fat/namei_vfat.c | 6 +-
fs/fhandle.c | 2 +-
fs/file_attr.c | 6 +-
fs/fuse/acl.c | 4 +-
fs/fuse/dir.c | 51 +++++++-------
fs/fuse/file.c | 2 +-
fs/fuse/fuse_i.h | 12 ++--
fs/fuse/ioctl.c | 2 +-
fs/fuse/req.c | 8 ++-
fs/fuse/xattr.c | 2 +-
fs/gfs2/acl.c | 2 +-
fs/gfs2/acl.h | 2 +-
fs/gfs2/file.c | 2 +-
fs/gfs2/inode.c | 16 ++---
fs/gfs2/inode.h | 4 +-
fs/gfs2/xattr.c | 2 +-
fs/hfs/attr.c | 2 +-
fs/hfs/dir.c | 6 +-
fs/hfs/hfs_fs.h | 2 +-
fs/hfs/inode.c | 2 +-
fs/hfsplus/dir.c | 10 +--
fs/hfsplus/hfsplus_fs.h | 4 +-
fs/hfsplus/inode.c | 6 +-
fs/hfsplus/xattr.c | 2 +-
fs/hfsplus/xattr_security.c | 2 +-
fs/hfsplus/xattr_trusted.c | 2 +-
fs/hfsplus/xattr_user.c | 2 +-
fs/hostfs/hostfs_kern.c | 14 ++--
fs/hpfs/hpfs_fn.h | 2 +-
fs/hpfs/inode.c | 2 +-
fs/hpfs/namei.c | 10 +--
fs/hugetlbfs/inode.c | 14 ++--
fs/inode.c | 12 ++--
fs/internal.h | 28 ++++----
fs/jffs2/acl.c | 2 +-
fs/jffs2/acl.h | 2 +-
fs/jffs2/dir.c | 20 +++---
fs/jffs2/fs.c | 2 +-
fs/jffs2/os-linux.h | 2 +-
fs/jffs2/security.c | 2 +-
fs/jffs2/xattr_trusted.c | 2 +-
fs/jffs2/xattr_user.c | 2 +-
fs/jfs/acl.c | 2 +-
fs/jfs/file.c | 2 +-
fs/jfs/ioctl.c | 2 +-
fs/jfs/jfs_acl.h | 2 +-
fs/jfs/jfs_inode.h | 4 +-
fs/jfs/namei.c | 10 +--
fs/jfs/xattr.c | 4 +-
fs/kernfs/dir.c | 4 +-
fs/kernfs/inode.c | 10 +--
fs/kernfs/kernfs-internal.h | 6 +-
fs/libfs.c | 8 +--
fs/minix/file.c | 2 +-
fs/minix/inode.c | 2 +-
fs/minix/minix.h | 2 +-
fs/minix/namei.c | 12 ++--
fs/mnt_idmapping.c | 33 +++++----
fs/namei.c | 84 +++++++++++------------
fs/namespace.c | 8 +--
fs/nfs/dir.c | 12 ++--
fs/nfs/inode.c | 4 +-
fs/nfs/internal.h | 10 +--
fs/nfs/namespace.c | 4 +-
fs/nfs/nfs3_fs.h | 2 +-
fs/nfs/nfs3acl.c | 2 +-
fs/nfs/nfs4proc.c | 10 +--
fs/nilfs2/inode.c | 4 +-
fs/nilfs2/ioctl.c | 2 +-
fs/nilfs2/namei.c | 10 +--
fs/nilfs2/nilfs.h | 6 +-
fs/ntfs/ea.c | 10 +--
fs/ntfs/ea.h | 6 +-
fs/ntfs/file.c | 4 +-
fs/ntfs/inode.h | 4 +-
fs/ntfs/namei.c | 12 ++--
fs/ntfs3/file.c | 6 +-
fs/ntfs3/inode.c | 2 +-
fs/ntfs3/namei.c | 10 +--
fs/ntfs3/ntfs_fs.h | 16 ++---
fs/ntfs3/xattr.c | 12 ++--
fs/ocfs2/acl.c | 2 +-
fs/ocfs2/acl.h | 2 +-
fs/ocfs2/dlmfs/dlmfs.c | 6 +-
fs/ocfs2/file.c | 6 +-
fs/ocfs2/file.h | 6 +-
fs/ocfs2/ioctl.c | 2 +-
fs/ocfs2/ioctl.h | 2 +-
fs/ocfs2/namei.c | 10 +--
fs/ocfs2/xattr.c | 6 +-
fs/omfs/dir.c | 6 +-
fs/omfs/file.c | 2 +-
fs/open.c | 6 +-
fs/orangefs/acl.c | 2 +-
fs/orangefs/inode.c | 8 +--
fs/orangefs/namei.c | 8 +--
fs/orangefs/orangefs-kernel.h | 8 +--
fs/orangefs/xattr.c | 2 +-
fs/overlayfs/dir.c | 14 ++--
fs/overlayfs/file.c | 2 +-
fs/overlayfs/inode.c | 16 ++---
fs/overlayfs/overlayfs.h | 14 ++--
fs/overlayfs/ovl_entry.h | 2 +-
fs/overlayfs/util.c | 4 +-
fs/overlayfs/xattrs.c | 4 +-
fs/pidfs.c | 6 +-
fs/posix_acl.c | 26 +++----
fs/proc/base.c | 10 +--
fs/proc/fd.c | 6 +-
fs/proc/fd.h | 2 +-
fs/proc/generic.c | 4 +-
fs/proc/internal.h | 4 +-
fs/proc/proc_net.c | 2 +-
fs/proc/proc_sysctl.c | 6 +-
fs/proc/root.c | 2 +-
fs/quota/dquot.c | 2 +-
fs/ramfs/file-nommu.c | 4 +-
fs/ramfs/inode.c | 10 +--
fs/remap_range.c | 2 +-
fs/smb/client/cifsacl.c | 4 +-
fs/smb/client/cifsfs.c | 2 +-
fs/smb/client/cifsfs.h | 16 ++---
fs/smb/client/cifsproto.h | 4 +-
fs/smb/client/dir.c | 6 +-
fs/smb/client/inode.c | 8 +--
fs/smb/client/link.c | 2 +-
fs/smb/client/xattr.c | 2 +-
fs/smb/server/ndr.c | 2 +-
fs/smb/server/ndr.h | 2 +-
fs/smb/server/oplock.c | 2 +-
fs/smb/server/smb2pdu.c | 22 +++---
fs/smb/server/smb_common.c | 2 +-
fs/smb/server/smbacl.c | 20 +++---
fs/smb/server/smbacl.h | 8 +--
fs/smb/server/vfs.c | 44 ++++++------
fs/smb/server/vfs.h | 28 ++++----
fs/stat.c | 4 +-
fs/tracefs/event_inode.c | 2 +-
fs/tracefs/inode.c | 8 +--
fs/ubifs/dir.c | 14 ++--
fs/ubifs/file.c | 4 +-
fs/ubifs/ioctl.c | 2 +-
fs/ubifs/ubifs.h | 6 +-
fs/ubifs/xattr.c | 2 +-
fs/udf/file.c | 2 +-
fs/udf/namei.c | 12 ++--
fs/udf/symlink.c | 2 +-
fs/ufs/inode.c | 2 +-
fs/ufs/namei.c | 10 +--
fs/ufs/ufs.h | 2 +-
fs/vboxsf/dir.c | 8 +--
fs/vboxsf/utils.c | 4 +-
fs/vboxsf/vfsmod.h | 4 +-
fs/xattr.c | 30 ++++-----
fs/xfs/libxfs/xfs_inode_util.h | 2 +-
fs/xfs/xfs_acl.c | 2 +-
fs/xfs/xfs_acl.h | 2 +-
fs/xfs/xfs_inode.c | 4 +-
fs/xfs/xfs_inode.h | 2 +-
fs/xfs/xfs_ioctl.c | 2 +-
fs/xfs/xfs_ioctl.h | 2 +-
fs/xfs/xfs_iops.c | 24 +++----
fs/xfs/xfs_iops.h | 2 +-
fs/xfs/xfs_itable.c | 2 +-
fs/xfs/xfs_itable.h | 2 +-
fs/xfs/xfs_symlink.c | 2 +-
fs/xfs/xfs_symlink.h | 2 +-
fs/xfs/xfs_xattr.c | 2 +-
fs/zonefs/super.c | 2 +-
include/linux/capability.h | 8 +--
include/linux/fileattr.h | 2 +-
include/linux/fs.h | 108 +++++++++++++++---------------
include/linux/lsm_hook_defs.h | 24 +++----
include/linux/mnt_idmapping.h | 24 +++----
include/linux/mount.h | 4 +-
include/linux/namei.h | 16 ++---
include/linux/nfs_fs.h | 6 +-
include/linux/posix_acl.h | 24 +++----
include/linux/quotaops.h | 6 +-
include/linux/security.h | 54 +++++++--------
include/linux/uidgid.h | 12 ++--
include/linux/xattr.h | 20 +++---
ipc/mqueue.c | 2 +-
kernel/bpf/inode.c | 6 +-
kernel/capability.c | 4 +-
kernel/user_namespace.c | 28 ++++----
mm/secretmem.c | 2 +-
mm/shmem.c | 30 ++++-----
net/socket.c | 6 +-
net/unix/af_unix.c | 2 +-
security/apparmor/apparmorfs.c | 2 +-
security/apparmor/lsm.c | 4 +-
security/commoncap.c | 10 +--
security/integrity/evm/evm_main.c | 26 +++----
security/integrity/ima/ima.h | 10 +--
security/integrity/ima/ima_api.c | 2 +-
security/integrity/ima/ima_appraise.c | 12 ++--
security/integrity/ima/ima_main.c | 6 +-
security/integrity/ima/ima_policy.c | 4 +-
security/security.c | 24 +++----
security/selinux/hooks.c | 14 ++--
security/selinux/selinuxfs.c | 2 +-
security/smack/smack_lsm.c | 14 ++--
virt/kvm/guest_memfd.c | 2 +-
296 files changed, 1156 insertions(+), 1135 deletions(-)
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 11/19 for v7.4] vfs iomap
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (9 preceding siblings ...)
2026-10-16 10:19 ` [GIT PULL 10/19 for v7.4] vfs idmap Christian Brauner
@ 2026-10-16 10:21 ` Christian Brauner
2026-10-16 10:21 ` [GIT PULL 12/19 for v7.4] vfs kernfs Christian Brauner
` (7 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:21 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This contains the iomap changes for this cycle.
The bulk is lazy bounce buffering for checksummed reads. XFS bounce
buffers every direct read on a device that requires stable pages for
checksumming so that userspace modifying the buffer while the read is
in flight can't corrupt the data and fail the checksum. That burns DRAM
bandwidth and CPU for copies that are almost never needed and, since
the bounce buffer was a bio_vec, produced smaller and unaligned I/Os
with 4k pages, i.e. 1 MB minus 4k. Now the read goes to the user buffer
first and only a checksum failure allocates a bounce buffer and reads
again. Integrity verification moves out of iomap into the filesystem
so it can handle errors its own way, T10 PI handling for direct I/O
moves into ->submit_io() to match buffered I/O, and a sysfs knob
restores the old behaviour for the rare application that really does
modify in-flight buffers. The block side gains bio_prepare_reissue(),
exports fs_bio_integrity_{alloc,free}(), caps atomic writes by the PI
buffer size and fixes an integer overflow in max_integrity_io_size()
and a PI verification bug with an initial bvec offset. The old read
side bounce buffering in the block layer is removed. This is a branch
shared with the block tree and may also reach you through the block
pull request.
Three error handling regressions are fixed. A failed
->writeback_submit() left wpc->wb_ctx pointing at an already completed
ioend which was then submitted a second time and corrupted
ip->i_ioend_list on XFS. iomap_fiemap() lost an iteration error when it
flushed the pending extent and marked a truncated list as complete. And
a failed direct I/O bio lost its error when the sub-block tail zeroing
succeeded. An XFS error tag to inject the writeback failure comes with
it.
iomap_dio_hole_iter() respects the block size alignment when
iov_iter_zero() stops short at a page boundary, which btrfs with 8k
blocks on 4k pages hit as an assertion since it disables page faults
during direct I/O. The homegrown deferral of error completions to task
context is replaced with bio_complete_in_task(). Plus an unused
parameter, two typo fixes and a kernel-doc fix.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit df2908090cda368b01ff43709f51890076c56157:
Linux 7.3-rc2 (2026-09-06 15:07:20 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.iomap
for you to fetch changes up to a0f61a936b36a340998825cb945e5fdf03468988:
fs/iomap: document ret parameter of iomap_iter_continue (2026-10-13 16:59:01 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.iomap
Please consider pulling these changes from the signed vfs-7.4-rc1.iomap tag.
Thanks!
Christian
----------------------------------------------------------------
Andrea Parri (4):
iomap: don't resubmit an ioend after ->writeback_submit() failed
xfs: add an error tag to inject a ->writeback_submit() failure
iomap: don't lose a fiemap iteration error when emitting the last extent
iomap: don't lose a failed direct I/O bio's error when zeroing the tail
Christian Brauner (4):
Merge patch series "iomap: fix typos and repeated words in comments"
Merge patch series "lazy bounce buffering for checksummed reads v3"
Merge patch series "use bio_complete_in_task for iomap error reporting"
Merge patch series "iomap: fix error handling regressions"
Christoph Hellwig (24):
block: avoid integer overflows in max_integrity_io_size
block: cap atomic write size by PI buffer size constraints
block: improve aligning down bios in bio_iov_iter_bounce_write
block: split bio_iov_iter_bounce_write
block: export fs_bio_integrity_{alloc,free}
block: add a bio_prepare_reissue helper
block: pass a maxlen argument to bio_iov_iter_get_pages
block: warn on too larger integrity allocations
iomap: respect maximum I/O size in iomap_dio_bio_iter_one
iomap: add a iomap_ioend_flags helper
iomap: add a IOMAP_IOEND_INTEGRITY flag
iomap,xfs: move T10 PI handling for direct I/O into ->submit_io
xfs: move PI generation into xfs_submit_zoned_bio
block,iomap: fix protection information verification with initial bvec offset
iomap: better read bounce buffering support
xfs: use BIO_COMPLETE_IN_TASK for bounce buffered read I/Os
iomap,xfs: move integrity verification to the file system
xfs: add support for lazy direct read bounce buffering
xfs: add error injection for lazy bounce buffering
xfs: log a message at mount time when using integrity protection
block,iomap: remove the old read side bounce buffering support
iomap: use bio_complete_in_task for buffered read failures
iomap: use bio_complete_in_task for buffered write failures
iomap: use bio_complete_in_task for buffered simple dio read failures
Hemanth Selam (2):
iomap: fix typo "metdata" in comment
iomap: fix repeated word 'the' in comment
Muhammad Mahdi Amirpour (1):
fs/iomap: document ret parameter of iomap_iter_continue
Pankaj Raghav (1):
iomap: remove the unused ifs parameter from ifs_find_dirty_range
Qu Wenruo (1):
iomap: follow the alignment requirement for iomap_dio_hole_iter()
Vincent Mailhol (1):
block: store GPT attributes as a raw value
block/bio-integrity-fs.c | 15 ++-
block/bio-integrity.c | 1 +
block/bio.c | 219 ++++++++++++++----------------------------
block/blk-map.c | 2 +-
block/blk-settings.c | 6 ++
block/fops.c | 3 +-
block/partitions/efi.h | 8 +-
fs/iomap/bio.c | 50 +---------
fs/iomap/buffered-io.c | 8 +-
fs/iomap/direct-io.c | 96 ++++++++----------
fs/iomap/fiemap.c | 8 +-
fs/iomap/ioend.c | 178 ++++++++++++++++++++++------------
fs/iomap/iter.c | 1 +
fs/xfs/libxfs/xfs_errortag.h | 8 +-
fs/xfs/xfs_aops.c | 13 +--
fs/xfs/xfs_buf.c | 11 +++
fs/xfs/xfs_file.c | 11 +--
fs/xfs/xfs_ioend.c | 137 ++++++++++++++++++++++++--
fs/xfs/xfs_ioend.h | 2 +
fs/xfs/xfs_mount.h | 8 ++
fs/xfs/xfs_reflink.c | 5 +
fs/xfs/xfs_super.c | 1 +
fs/xfs/xfs_sysfs.c | 78 ++++++++++++++-
fs/xfs/xfs_trace.h | 1 +
fs/xfs/xfs_zone_alloc.c | 4 +
include/linux/bio-integrity.h | 3 +-
include/linux/bio.h | 11 ++-
include/linux/blkdev.h | 8 +-
include/linux/iomap.h | 38 +++++++-
29 files changed, 565 insertions(+), 369 deletions(-)
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 12/19 for v7.4] vfs kernfs
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (10 preceding siblings ...)
2026-10-16 10:21 ` [GIT PULL 11/19 for v7.4] vfs iomap Christian Brauner
@ 2026-10-16 10:21 ` Christian Brauner
2026-10-16 10:22 ` [GIT PULL 13/19 for v7.4] vfs lookup Christian Brauner
` (6 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:21 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This contains kernfs scalability work from Shakeel driven by what Meta
sees in their fleet. kernfs_rwsem is per kernfs root, so sysfs and
cgroupfs each have one for the whole machine, and every create, remove
and rename takes it for writing. rwsems don't let readers steal the lock
once a writer is queued, so one cgroup being created or a device being
renamed parks the entire incoming reader stream in uninterruptible
sleep. Daemons that poll cgroup files in a loop turn that into a convoy
and the two that hurt most, oomd and below, are the ones that are
supposed to relieve memory pressure and record what happened.
kernfs_dop_revalidate() took kernfs_rwsem for read once per path
component of every walk into a kernfs mount. Nothing it reads needs the
semaphore. kn->active is an atomic_t, kn->__parent and kn->name are rcu
pointers, kn->ns can be compared instead of dereferenced and the
directory revision is a plain counter. The callback runs under rcu now.
Readers walking cgroupfs and sysfs while another thread churns cgroups,
renames netdevs and plugs devices went from 48,593,360 read
acquisitions and 1,744,517 contentions to 1,280,280 and 429,846 on an
8-CPU VM and path walk throughput improved 35-53%. LOOKUP_RCU still
returns ECHILD because kernfs_iop_permission() forces every walk out of
rcu-walk anyway. That is left for later.
kernfs_fop_readdir() held the semaphore across dir_emit(). dir_emit()
copies to userspace and under memory pressure that fault goes to
reclaim with the lock every create, remove and rename needs held for
reading. Meta sees 120 second allocation stalls in filldir64() from
below and systemd-oomd stuck behind it. The lock is dropped around
dir_emit() now. Since the entry the listing stopped on can disappear in
that window and two entries can share a hash, readdir resumes on the
full (hash, ns, name) key and the fallback search lands after the
missing entry instead of repeating or skipping one. The repeat was a
pre-existing bug between two getdents(2) calls.
Three more lock holds are shortened. kernfs_notify_workfn() no longer
holds kernfs_rwsem across fsnotify() which allocates against the memcg
of the watching cgroup that is already under pressure. The open node is
allocated outside the hashed open file mutex, the most contended lock
in kernfs on their fleet with 2.19M waiters over 29 days and a 77ms
median hold. A new node is activated without dropping and retaking the
write lock, lock_stat says 1200 -> 830 write acquisitions for five
dummy netdevs, and kernfs_rename_ns() allocates the new name before and
frees the old one after the lock so a rename can't enter reclaim or
wait out a grace period with it held.
Three standalone fixes come with selftests. Same-parent renames take
kernfs_rename_lock too so kernfs_path_from_node() can't build a path
that never existed. Decoding a file handle takes the semaphore so a
decode racing rmdir() can't hash an inode after the removal's ilookup()
pass and lose IN_DELETE_SELF. And kernfs_create_link() reads the
target's uid and gid under kernfs_iattr_rwsem so a chown in between
can't give the link an owner the target never had. The kernfs selftests
grew from two xattr checks to coverage of dentry revalidation, rename,
namespace tagging, file handles and readdir under churn.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.kernfs
for you to fetch changes up to 1c45110a23bd7fb4a1a7d5f5a1014c5b688844ae:
Merge patch series "kernfs: do less work under the kernfs_rwsem write lock" (2026-09-25 16:59:12 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.kernfs
Please consider pulling these changes from the signed vfs-7.4-rc1.kernfs tag.
Thanks!
Christian
----------------------------------------------------------------
Christian Brauner (4):
Merge patch series "kernfs: remove kernfs_rwsem from dentry revalidation"
Merge patch series "kernfs: three standalone fixes"
Merge patch series "kernfs: don't hold kernfs_rwsem across dir_emit()"
Merge patch series "kernfs: do less work under the kernfs_rwsem write lock"
Shakeel Butt (18):
kernfs: Use VFS lookup context in d_revalidate()
kernfs: Prepare directory revisions for lockless reads
kernfs: Avoid namespace dereference in d_revalidate()
kernfs: Remove kernfs_rwsem from dentry revalidation
selftests: cover kernfs dentry revalidation
selftests: cover kernfs file handles and same-parent rename
kernfs: take kernfs_rename_lock for same-parent renames too
kernfs: don't lose IN_DELETE_SELF when decoding a file handle
kernfs: fix up the unlocked attribute reads on the creation paths
kernfs: allocate the open node outside the open file mutex
kernfs: don't hold kernfs_rwsem across notification delivery
kernfs: don't repeat or skip an entry when readdir resumes
kernfs: resume readdir on the full entry key
kernfs: don't hold kernfs_rwsem across dir_emit()
selftests: cover readdir resuming at a removed entry
kernfs: activate a new node without dropping kernfs_rwsem
kernfs: allocate the new name outside kernfs_rwsem
kernfs: free the old name outside kernfs_rwsem
MAINTAINERS | 1 +
fs/kernfs/dir.c | 225 ++--
fs/kernfs/file.c | 47 +-
fs/kernfs/kernfs-internal.h | 18 +-
fs/kernfs/mount.c | 32 +-
fs/kernfs/symlink.c | 17 +-
tools/testing/selftests/filesystems/config | 8 +
tools/testing/selftests/filesystems/kernfs_test.c | 1187 ++++++++++++++++++++-
8 files changed, 1414 insertions(+), 121 deletions(-)
create mode 100644 tools/testing/selftests/filesystems/config
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 13/19 for v7.4] vfs lookup
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (11 preceding siblings ...)
2026-10-16 10:21 ` [GIT PULL 12/19 for v7.4] vfs kernfs Christian Brauner
@ 2026-10-16 10:22 ` Christian Brauner
2026-10-16 10:23 ` [GIT PULL 14/19 for v7.4] vfs misc Christian Brauner
` (5 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:22 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This prepares for Neil's changes to directory locking. The goal is for
the VFS to lock the dentry and not the parent directory and to push the
i_rwsem parent locking down into the filesystems where it can be kept,
removed or adjusted as each filesystem sees fit.
The next step in that is to swap the lock order of d_alloc_parallel()
and i_rwsem so code can wait on i_rwsem while holding an in-lookup
dentry. Two things have to change before that can happen. Nobody may
call d_alloc_parallel() while holding i_rwsem, and nobody may d_drop()
a dentry while it is being worked on since that effectively unlocks an
in-lookup dentry and lets another one be allocated too early.
So d_splice_alias() learns to handle hashed dentries in addition to
unhashed and in-lookup ones, which is what ->atomic_open() needs and
removes the reason filesystems d_drop() first. d_alloc_trylock() is a
non-blocking d_alloc_parallel() for the filesystems that prime the
dcache from readdir, smb, nfs, fuse and ceph, where waiting for a
concurrent lookup is pointless. d_duplicate() creates an in-lookup
dentry with the name of an existing one for silly-rename and whiteouts.
LOOKUP_SHARED tells ->lookup() how the parent is locked so it can drop
and retake it. DCACHE_PAR_LOOKUP is tracked by lockdep now with a per
filesystem type key, and overlayfs gets its own class since it stacks
over itself. And a d_flags bit is reserved for filesystem private use.
Also included is Mateusz's fix for the spurious dentry reference cycle
on open. __legitimize_path() grabs a reference, do_dentry_open() grabs
another and terminate_walk() drops the first. do_dentry_open() consumes
the held reference now. Opening the same file read-only on a 20-core VM
goes from 4043375 to 5629378 ops/s in will-it-scale.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
This conflicts with the vfs-7.4-rc1.idmap tag in fs/namei.c between
commit 025756ee7b476 ("fs: port mnt_idmap() and file_mnt_idmap() to
const mnt_idmap") from that tag and commit 161ce1e692d01 ("fs: avoid
spurious dentry ref/unref cycle on open") from this tag. The idmap tag
is merged before this one:
diff --cc fs/namei.c
index 3fc7572e917a,d4b2e5883cba..000000000000
--- a/fs/namei.c
+++ b/fs/namei.c
@@@ -4788,7 -4791,8 +4790,8 @@@ finish_lookup
static int do_open(struct nameidata *nd,
struct file *file, const struct open_flags *op)
{
+ struct vfsmount *mnt;
- struct mnt_idmap *idmap;
+ const struct mnt_idmap *idmap;
int open_flag = op->open_flag;
bool do_truncate;
int acc_mode;
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.lookup
for you to fetch changes up to 31fbbc8bb1ca256f3d27d1172ad3493d46d29c73:
VFS: d_duplicate: repair comments to avoid kernel-doc warnings (2026-10-16 11:14:51 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.lookup
Please consider pulling these changes from the signed vfs-7.4-rc1.lookup tag.
Thanks!
Christian
----------------------------------------------------------------
Christian Brauner (2):
Merge patch series "VFS: prepare for changes to directory locking"
Merge patch series "Fixes for dentry lockdep tracking on stacking filesystems"
Mateusz Guzik (1):
fs: avoid spurious dentry ref/unref cycle on open
NeilBrown (10):
VFS: fix various typos in documentation for start_creating start_removing etc
VFS: enhance d_splice_alias() to handle hashed dentries
VFS: introduce d_alloc_trylock()
VFS: add d_duplicate()
VFS: Add LOOKUP_SHARED flag.
VFS: add lockdep monitoring of DCACHE_PAR_LOOKUP lock.
VFS: reserve a d_flags bit for fs-specific usage
VFS: per-fs-type lockdep key for dentry in-lookup locking
VFS: rename lookup_map to dep_map
ovl: provide private lockdep class for dentry->dep_map
Randy Dunlap (1):
VFS: d_duplicate: repair comments to avoid kernel-doc warnings
Documentation/filesystems/porting.rst | 10 +-
Documentation/filesystems/vfs.rst | 4 +-
fs/dcache.c | 177 ++++++++++++++++++++++++++++++----
fs/internal.h | 1 +
fs/namei.c | 69 +++++++------
fs/nfs/unlink.c | 3 +
fs/open.c | 27 +++++-
fs/overlayfs/inode.c | 1 -
fs/overlayfs/overlayfs.h | 2 +
fs/overlayfs/super.c | 19 ++++
include/linux/dcache.h | 38 +++++++-
include/linux/fs.h | 2 +
include/linux/namei.h | 3 +-
13 files changed, 296 insertions(+), 60 deletions(-)
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 14/19 for v7.4] vfs misc
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (12 preceding siblings ...)
2026-10-16 10:22 ` [GIT PULL 13/19 for v7.4] vfs lookup Christian Brauner
@ 2026-10-16 10:23 ` Christian Brauner
2026-10-16 10:24 ` [GIT PULL 15/19 for v7.4] vfs mount Christian Brauner
` (4 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:23 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
Fixes
- aio: a keyed poll completion on an epoll instance could recurse into
the same epoll waitqueue lock when the result eventfd is watched by
that very instance. An unprivileged process could make a CPU spin on
the recursive lock. eventfd-backed poll completions are always
deferred now.
- fsnotify_inoderemove() is only called once the inode is really dead,
no nlink and no aliases, and open_by_handle_at() can't add an alias
to a dead inode anymore. The race could crash fsnotify or lose inode
mark notifications.
- devtmpfs: the conversion of the public instance to ->get_tree() broke
reconfiguring the shared superblock's options on later mounts which
made the boot time defaults permanent. A reconfigure context is kept
in fc->fs_private so the parse ops can forward options to the
underlying filesystem.
- ufs truncated the 64-bit directory size to an unsigned int in
ufs_last_byte(). A crafted image with a 4 GiB directory produced an
out-of-folio read in ufs_find_entry() and, with CONFIG_UFS_FS_WRITE,
a write into an adjacent page.
- devpts rejects max=0 instead of silently lifting the per-instance pty
limit. The value wrapped into ida_alloc_max() and became unlimited.
- fs_pin publishes pins with the rcu list helpers so the kill paths
reading the lists under rcu see the initialization.
- dentry_kill() reports a Tasks-RCU quiescent state. Its cond_resched()
is the only reschedule point on the dentry teardown path and
cond_resched() isn't a quiescent state for Tasks-RCU, so Meta kept
seeing rcu_tasks stalls in btrfs subvolume deletion.
- writeback sizes foreign flushes by the target wb's dirty pages instead
of the memcg-wide count which over or undersized a single bdi flush.
- nfsd READ emitted two fsnotify access events on the iterator path
since vfs_iocb_iter_read() already sends one. A READ on a krb5i or
krb5p mount showed up twice in inotify.
- pipe and splice pass a poll key when waking readers and writers so
epoll, poll() and select() waiters only wake for the event they asked
for.
- the iso8859-14 Unicode to charset tables had page01 duplicated as
page1e so 29 code points mapped to the wrong bytes and 22 that aren't
in the charset were accepted.
- orangefs doesn't wait for an unmount service operation that never
returns on system shutdown and uses ssize_t for strscpy() errors.
- __register_chrdev() checks the kobject_set_name() return value.
- selftest fixes: the openat2 tests hardcoded O_LARGEFILE to 0x8000
which is O_NOFOLLOW on powerpc, resolve_test makes /tmp a mountpoint
so RESOLVE_NO_XDEV has a boundary to trip over, file_stressor moves
into its own directory with a 30 minute timeout, the kernfs listxattr
test skips when SELinux exposes security.selinux, the namespaces
active reference tests wait for the thread via a PIDFD_THREAD pidfd
since pthread_join() returns before exit_nsproxy_namespaces(), the
idmapped_tmpfile test chowns its directory into the mapped range, the
clone3 CLONE_CLEAR_SIGHAND test adds CLONE_VM so it fails for the
intended reason, the pidfd PPID error message prints the values it
compares and fscontext_ns gets a .gitignore.
Cleanups
- vmcore prints the release of the crashed kernel from the VMCOREINFO
note so a kdump that dies before the dump lands still says which
kernel it was for.
- initramfs allocates hardlink hash entries with the validated cpio
name length instead of PATH_MAX, which put every entry in kmalloc-8k.
- the unused dax_layout_busy_page() is removed,
dax_layout_busy_page_range() becomes static and dax_folio_init()
drops a redundant list initialization.
- vfs_empty_path() is removed, it has had no callers since
getname_maybe_null().
- comment and documentation fixes in aio, bpf_fs_kfuncs, fs-writeback,
inode, read_write, squashfs and the vfs.rst copy of struct
file_system_type.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
This conflicts with mainline in tools/testing/selftests/Makefile and
tools/testing/selftests/filesystems/Makefile between commits
d59ac79915daa ("selftests/filesystems: fix missing and stale TARGETS
entries") and 66cda7ec9abec ("selftests/filesystems: check that an
immutable inode takes no write hint") in mainline and commit
5550456dad376 ("selftests/filesystems: Move file_stressor to dedicated
subdirectory") from this tree:
diff --cc tools/testing/selftests/Makefile
index bc4fdb6f5337,08f228765a93..000000000000
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@@ -35,11 -35,9 +35,12 @@@ TARGETS += fchmodat
TARGETS += filesystems
TARGETS += filesystems/binderfs
TARGETS += filesystems/epoll
+TARGETS += filesystems/eventfd
TARGETS += filesystems/failfs
TARGETS += filesystems/fat
+ TARGETS += filesystems/file_stressor
+TARGETS += filesystems/openat2
+TARGETS += filesystems/open_tree_ns
TARGETS += filesystems/overlayfs
TARGETS += filesystems/statmount
TARGETS += filesystems/mount-notify
diff --cc tools/testing/selftests/filesystems/Makefile
index 93e2cc9123b0,bc4bfb677589..000000000000
--- a/tools/testing/selftests/filesystems/Makefile
+++ b/tools/testing/selftests/filesystems/Makefile
@@@ -1,7 -1,7 +1,7 @@@
# SPDX-License-Identifier: GPL-2.0
CFLAGS += $(KHDR_INCLUDES)
- TEST_GEN_PROGS := devpts_pts file_stressor anon_inode_test kernfs_test fclog ustat_test rw_hint_test
-TEST_GEN_PROGS := devpts_pts anon_inode_test kernfs_test fclog ustat_test
++TEST_GEN_PROGS := devpts_pts anon_inode_test kernfs_test fclog ustat_test rw_hint_test
TEST_GEN_PROGS += idmapped_tmpfile
TEST_GEN_PROGS_EXTENDED := dnotify_test
It also conflicts with the vfs-7.4-rc1.coredump tag in fs/coredump.c
between commit 3aa5ebec7895c ("coredump: describe the holes when
COREDUMP_SPARSE is negotiated") from that tag and commit 21a62663d4734
("fs: fix typos in comments") from this tag. The coredump tag is merged
before this one. The typo fix touches a comment the coredump tag
rewrites, so the coredump tag's version of the comment wins.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.misc
for you to fetch changes up to 9ba6627ef6b12debd1c54443939718db63234274:
selftests/filesystems: Fix idmapped_tmpfile layer dir ownership (2026-10-12 11:24:28 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.misc
Please consider pulling these changes from the signed vfs-7.4-rc1.misc tag.
Thanks!
Christian
----------------------------------------------------------------
Ali Ahmet Memiş (1):
nls: fix the Unicode to charset tables of iso8859-14
Amir Goldstein (1):
fs: make sure to call fsnotify_inoderemove() only once when inode is dead
Bjoern Doebel (1):
selftests/filesystems: Fix idmapped_tmpfile layer dir ownership
Breno Leitao (4):
pipe: pass a poll key when waking writers after a resize
splice: pass a poll key when waking pipe readers and writers
vmcore: report the release of the crashed kernel
dcache: report a Tasks-RCU quiescent state in dentry_kill()
Christian Brauner (3):
Merge patch series "selftests/filesystems: selftest fixes"
Merge patch series "fs/dax: Clean up busy page lookup helpers"
Merge patch series "selftests/filesystems/openat2: fix O_LARGEFILE definitions for non-arm64 architectures"
Chuck Lever (1):
splice: emit a single fsnotify access event per NFSD READ
Daehyeon Ko (1):
aio: prevent eventfd/epoll recursion on poll
Disha Goel (4):
selftests/filesystems: Move file_stressor to dedicated subdirectory
selftests/filesystems: skip listxattr kernfs test if xattrs are present
selftests/filesystems/openat2: fix O_LARGEFILE definitions for non-arm64 architectures
selftests/filesystems/openat2: make /tmp a mountpoint inside private namespace
Eric Sandeen (1):
devtmpfs: restore mount option reconfiguration on get_tree
Hemanth Selam (1):
fs: fix typos in comments
Kaitao Cheng (3):
fs/dax: Remove redundant deferred list initialization
fs/dax: Remove unused dax_layout_busy_page()
fs/dax: Make dax_layout_busy_page_range() static
Karl Mehltretter (2):
fs_pin: publish pins with RCU list helpers
docs/vfs: Fix the struct file_system_type copy
Mahad Ibrahim (1):
selftests/filesystems: Add .gitignore for fscontext_ns_test
Manush Prajwal (3):
fs: fix comment typo in bpf_fs_kfuncs.c
fs: fix comment typo in fs-writeback.c
fs: fix comment typo in inode.c
Mark Sercombe (1):
fs/aio: fix comment typos
Mike Marshall (2):
orangefs_super: don't wait on service operation on system shutdown.
orangefs: use ssize_t instead of size_t for error codes...
Paul Dolan (2):
selftests/clone3: tighten CLONE_CLEAR_SIGHAND conflict test
selftests/pidfd: fix PPID values in error message
Ray Lee (1):
squashfs: fix inode number description in documentation
Ricardo B. Marlière (SUSE) (1):
selftests/namespaces: Wait for thread exit via pidfd in active-ref tests
Sang-Heon Jeon (1):
fs: remove unused vfs_empty_path()
Tao Cui (1):
devpts: reject max=0 instead of silently lifting the limit
Thorsten Blum (1):
initramfs: Reduce hardlink hash allocation sizes
Xin Yin (1):
writeback: size foreign flushes by target wb dirty pages
YANXIN LI (1):
ufs: use u64 for directory size in ufs_last_byte
Yingchao Deng (1):
fs: fix misleading comments in read_write.c
bui duc phuc (1):
chardev: check return value of kobject_set_name() in __register_chrdev()
Documentation/filesystems/squashfs.rst | 6 +-
Documentation/filesystems/vfs.rst | 2 +-
drivers/base/devtmpfs.c | 108 ++++++++++++---------
fs/aio.c | 11 ++-
fs/bpf_fs_kfuncs.c | 4 +-
fs/char_dev.c | 4 +-
fs/coredump.c | 2 +-
fs/dax.c | 26 ++---
fs/dcache.c | 29 +++++-
fs/devpts/inode.c | 2 +
fs/fs-writeback.c | 23 ++---
fs/fs_pin.c | 9 +-
fs/inode.c | 2 +-
fs/namespace.c | 2 +-
fs/nfsd/vfs.c | 13 +--
fs/nls/nls_iso8859-14.c | 26 +++--
fs/orangefs/orangefs-debugfs.c | 10 +-
fs/orangefs/super.c | 18 ++++
fs/pipe.c | 2 +-
fs/proc/vmcore.c | 20 ++++
fs/read_write.c | 8 +-
fs/splice.c | 70 +++++++++----
fs/ufs/dir.c | 2 +-
include/linux/dax.h | 12 ---
include/linux/fs.h | 19 +---
include/linux/splice.h | 4 +-
include/uapi/linux/fs.h | 2 +-
init/initramfs.c | 11 ++-
tools/testing/selftests/Makefile | 1 +
.../selftests/clone3/clone3_clear_sighand.c | 6 +-
tools/testing/selftests/filesystems/.gitignore | 1 -
tools/testing/selftests/filesystems/Makefile | 2 +-
.../selftests/filesystems/file_stressor/.gitignore | 2 +
.../selftests/filesystems/file_stressor/Makefile | 6 ++
.../{ => file_stressor}/file_stressor.c | 0
.../selftests/filesystems/file_stressor/settings | 3 +
.../selftests/filesystems/fscontext_ns/.gitignore | 2 +
.../selftests/filesystems/idmapped_tmpfile.c | 7 ++
tools/testing/selftests/filesystems/kernfs_test.c | 16 ++-
.../selftests/filesystems/openat2/openat2_test.c | 10 +-
.../selftests/filesystems/openat2/resolve_test.c | 7 +-
.../selftests/namespaces/ns_active_ref_test.c | 29 ++++++
tools/testing/selftests/pidfd/pidfd_open_test.c | 2 +-
43 files changed, 340 insertions(+), 201 deletions(-)
create mode 100644 tools/testing/selftests/filesystems/file_stressor/.gitignore
create mode 100644 tools/testing/selftests/filesystems/file_stressor/Makefile
rename tools/testing/selftests/filesystems/{ => file_stressor}/file_stressor.c (100%)
create mode 100644 tools/testing/selftests/filesystems/file_stressor/settings
create mode 100644 tools/testing/selftests/filesystems/fscontext_ns/.gitignore
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 15/19 for v7.4] vfs mount
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (13 preceding siblings ...)
2026-10-16 10:23 ` [GIT PULL 14/19 for v7.4] vfs misc Christian Brauner
@ 2026-10-16 10:24 ` Christian Brauner
2026-10-16 10:25 ` [GIT PULL 16/19 for v7.4] vfs netfs Christian Brauner
` (3 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:24 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This adds OPEN_TREE_DROP_MNTNS_MOUNTS.
crun started using OPEN_TREE_NAMESPACE to set up the container's mount
namespace and open_tree(OPEN_TREE_CLONE) for the sources of its bind
mounts. That fails on any host with a mount namespace pinned below such
a source. The recursive clone picks the pinned namespace up and
move_mount() refuses to attach the tree with ELOOP. Only a younger
mount namespace may ever be bound into an older one or mount namespace
references could form a loop. A namespace created with
OPEN_TREE_NAMESPACE is younger than everything else on the system so
from inside it every pinned namespace is older.
By the time this fails setns() has run and the host tree is out of
reach, so the runtime has to predict the situation beforehand and lose
the optimization. snapd pins mount namespaces under /run/snapd/ns so on
Ubuntu that is any container bind mounting the host root.
Every other path crossing a mount namespace boundary already leaves
these mounts behind, copy_mnt_ns() and create_new_namespace() both do.
Only get_detached_copy() asks for them. The new flag lets a caller get
a clone without them. It stays opt-in because open_tree(OPEN_TREE_CLONE)
plus move_mount() is mount --rbind through a file descriptor and
dropping them by default would silently lose /run/snapd/ns/*.mnt on a
live system. It requires AT_RECURSIVE, is a no-op with
OPEN_TREE_NAMESPACE and skips locked nsfs mounts the way copy_mnt_ns()
does, so nothing new is exposed. Selftests are included.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907:
Linux 7.3-rc7 (2026-10-11 20:04:55 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.mount
for you to fetch changes up to 062b32e4b55082f11b63dce22c78cd00fc6c7ed5:
Merge patch series "mount: add OPEN_TREE_DROP_MNTNS_MOUNTS" (2026-10-12 11:33:23 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.mount
Please consider pulling these changes from the signed vfs-7.4-rc1.mount tag.
Thanks!
Christian
----------------------------------------------------------------
Christian Brauner (1):
Merge patch series "mount: add OPEN_TREE_DROP_MNTNS_MOUNTS"
Kir Kolyshkin (2):
mount: add OPEN_TREE_DROP_MNTNS_MOUNTS
selftests/filesystems: test OPEN_TREE_DROP_MNTNS_MOUNTS
fs/namespace.c | 16 +-
include/uapi/linux/mount.h | 1 +
.../filesystems/open_tree_ns/open_tree_ns_test.c | 193 +++++++++++++++++++++
3 files changed, 208 insertions(+), 2 deletions(-)
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 16/19 for v7.4] vfs netfs
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (14 preceding siblings ...)
2026-10-16 10:24 ` [GIT PULL 15/19 for v7.4] vfs mount Christian Brauner
@ 2026-10-16 10:25 ` Christian Brauner
2026-10-16 10:26 ` [GIT PULL 17/19 for v7.4] vfs shared net-next pidfd Christian Brauner
` (2 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:25 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This contains the netfs and cachefiles changes for this cycle from
David.
Cachefiles learns to cache the most common class of files properly,
files that are created or truncated, written once sequentially and
closed. So far it relied on the backing filesystem's idea of what is
stored and asked with SEEK_DATA and SEEK_HOLE before every read it
prepared, two seeks per read, and the backing filesystem is free to
insert or remove runs of zeros which produces false positives and false
negatives. The object type in the state xattr is now actually set to
CACHEFILES_CONTENT_{SINGLE,ALL,BACKFS_MAP} instead of zero. For files
written contiguously the type is ALL, the backing file's i_size tracks
how much is cached and the object size lives in the xattr, and reads
skip the seeks entirely. Netfslib queries the cache occupancy through a
new ->query_occupancy() method that returns up to two extents at once,
->prepare_read() only limits the size of a cache read anymore and a new
->collect_write() lets the cache update its metadata once a contiguous
run of writes completes. The state xattr is preset when the tmpfile is
created so ENOSPC from setxattr can't scrap a fully written cache file.
Two fixes for this followed, one for resize handling where the cache's
idea of the size can be stale and one for an unset error that hung a
request on a failed cache write.
Preparatory work converts file positions that can't be negative to
uoff_t, removes the writethrough code whose locking looked like it
could deadlock with ceph snapshots, makes the deprecated PG_private_2
support opt-in so mm can get its page bit back, adds helpers for the
NETFS_RREQ_ALL_QUEUED barriers and adds the cache object id to the read
and write tracepoints. Plus an unused header removal and two
documentation fixes.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit a90ee4305c4a5df72c11b31dacfdc76e00fcf78a:
Linux 7.3-rc6 (2026-10-04 13:45:25 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.netfs
for you to fetch changes up to b6134f76740497004f72954ae67bd4ba45d2f044:
fscache, cachefiles: Fix resize handling (2026-10-16 11:02:26 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.netfs
Please consider pulling these changes from the signed vfs-7.4-rc1.netfs tag.
Thanks!
Christian
----------------------------------------------------------------
Christian Brauner (2):
Merge patch series "netfs: Miscellaneous preparatory changes"
Merge patch series "netfs, cachefiles: Changes for next, primarily occupancy tracking-related"
David Howells (15):
netfs: Use uoff_t instead of unsigned long long and loff_t
netfs: Remove the writethrough code
netfs: trace: Change the "clear" folio traces to "endwb"
netfs: trace: Rejig a couple of the tracepoints
netfs: Add the cache object ID to netfs_read/write tracepoints
netfs: Make deprecated PG_private_2 support opt-in
netfs: Add some functions to wrap the all-queued handling
netfs: Set subrequest->source at alloc before trace emission
cachefiles: Clean up cachefiles_do_prepare_read()
netfs, cachefiles: Add a couple of traces for write failure
cachefiles: Add a tracepoint to log insufficient space errors
cachefiles: Don't rely on backing fs storage map for most use cases
cachefiles: Preset the state xattr when creating a new file
cachefiles: Fix unset error when calling netfs_prepare_write_failed()
fscache, cachefiles: Fix resize handling
Ethan Nelson-Moore (1):
netfs: remove unused fscache_internal.h header
Karl Mehltretter (1):
netfs: Document the remote size member and its accessors
Zenghui Yu (1):
cachefiles: Fix path of the "debug" module parameter in help paragraph
Documentation/filesystems/caching/backend-api.rst | 2 +-
Documentation/filesystems/caching/netfs-api.rst | 2 +-
Documentation/filesystems/netfs_library.rst | 7 +-
fs/9p/vfs_addr.c | 1 -
fs/9p/vfs_inode.c | 6 +-
fs/9p/vfs_inode_dotl.c | 5 +-
fs/afs/file.c | 8 +-
fs/afs/inode.c | 4 +-
fs/afs/internal.h | 2 +-
fs/cachefiles/Kconfig | 2 +-
fs/cachefiles/interface.c | 96 +----
fs/cachefiles/internal.h | 18 +-
fs/cachefiles/io.c | 474 ++++++++++++++--------
fs/cachefiles/namei.c | 34 +-
fs/cachefiles/xattr.c | 82 +++-
fs/ceph/Kconfig | 1 +
fs/ceph/addr.c | 4 +-
fs/ceph/cache.h | 6 +-
fs/ceph/inode.c | 16 +-
fs/ceph/super.h | 3 +-
fs/netfs/Kconfig | 3 +
fs/netfs/Makefile | 2 +-
fs/netfs/buffered_read.c | 219 ++++++----
fs/netfs/buffered_write.c | 69 +---
fs/netfs/direct_read.c | 14 +-
fs/netfs/direct_write.c | 8 +-
fs/netfs/fscache_cookie.c | 8 +-
fs/netfs/fscache_internal.h | 14 -
fs/netfs/fscache_io.c | 12 +-
fs/netfs/internal.h | 70 +++-
fs/netfs/iterator.c | 2 +-
fs/netfs/main.c | 1 -
fs/netfs/misc.c | 10 +-
fs/netfs/objects.c | 7 +-
fs/netfs/read_collect.c | 14 +-
fs/netfs/read_pgpriv2.c | 13 +-
fs/netfs/read_retry.c | 7 +-
fs/netfs/read_single.c | 50 +--
fs/netfs/stats.c | 4 +-
fs/netfs/write_collect.c | 157 +++++--
fs/netfs/write_issue.c | 142 ++-----
fs/netfs/write_retry.c | 8 +-
fs/nfs/Kconfig | 1 +
fs/smb/client/cifsfs.c | 6 +-
fs/smb/client/inode.c | 2 +-
fs/smb/client/smb2ops.c | 9 +-
include/linux/fscache-cache.h | 2 +-
include/linux/fscache.h | 60 ++-
include/linux/netfs.h | 112 +++--
include/trace/events/cachefiles.h | 81 +++-
include/trace/events/fscache.h | 10 +-
include/trace/events/netfs.h | 145 +++----
52 files changed, 1149 insertions(+), 886 deletions(-)
delete mode 100644 fs/netfs/fscache_internal.h
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 17/19 for v7.4] vfs shared net-next pidfd
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (15 preceding siblings ...)
2026-10-16 10:25 ` [GIT PULL 16/19 for v7.4] vfs netfs Christian Brauner
@ 2026-10-16 10:26 ` Christian Brauner
2026-10-16 10:26 ` [GIT PULL 18/19 for v7.4] vfs shared super Christian Brauner
2026-10-16 10:27 ` [GIT PULL 19/19 for v7.4] vfs sync_close Christian Brauner
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:26 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This adds thread specific pidfds to af_unix sockets.
SO_PASSPIDFD and SO_PEERPIDFD hand out a pidfd for the thread-group
leader. A coredump server on the coredump socket can't get a handle on
the thread that took the signal and is writing the dump, and anything
doing per-thread authentication has the same problem. The sending and
the connecting thread are recorded in addition to the thread-group
leader and sk_peer_pid becomes an array indexed by pid type.
SO_PASSPIDFD_THREAD works like SO_PASSPIDFD but delivers an
SCM_PIDFD_THREAD cmsg for the sending thread. Both options are
independent so a receiver can ask for both. On SOCK_STREAM sockets
recvmsg() only stops merging data at a thread boundary when the
receiver asked for a thread pidfd. SO_PEERPIDFD_THREAD returns a pidfd
for the thread that called connect(), listen() or socketpair(). pidfs
records the coredump on the dumping thread's struct pid too so its
pidfd reports it like the leader's does. Selftests for af_unix and the
coredump socket are included.
This is a branch shared with net-next so these changes may also reach
you through the networking pull request.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
This conflicts with the vfs-7.4-rc1.coredump tag in
tools/testing/selftests/coredump/coredump_test.h and
tools/testing/selftests/coredump/coredump_test_helpers.c between commit
eec8727ba2730 ("selftests/coredump: add a separate helper header") from
that tag and commit 1f47b275d5d5a ("selftests/coredump: check the
dumping thread's pidfd") from this tag. The coredump tag is merged
before this one. In coredump_test.h the coredump tag's version wins
since it moved every declaration into coredump_test_helpers.h. In
coredump_test_helpers.c the SO_PEERPIDFD_THREAD fallback define and the
crashing_child_thread() and get_peer_pidfd_thread() helpers from this
tag are kept on top of the coredump tag's rewrite of the file. The
first hunk is the interesting one, the rest of the combined diff is a
1200 line wall of one-sided context:
diff --cc tools/testing/selftests/coredump/coredump_test_helpers.c
index 91607e09127f,36306069f62e..000000000000
--- a/tools/testing/selftests/coredump/coredump_test_helpers.c
+++ b/tools/testing/selftests/coredump/coredump_test_helpers.c
@@@ -30,16 -21,28 +30,20 @@@
#include <unistd.h>
#include "../filesystems/wrappers.h"
-#include "../pidfd/pidfd.h"
+#include "coredump_notify_signal.h"
-/* Forward declarations to avoid including harness header */
-struct __test_metadata;
+#include "coredump_test_helpers.h"
-/* Match the fixture definition from coredump_test.h */
-struct _fixture_coredump_data {
- char original_core_pattern[256];
- pid_t pid_coredump_server;
- int fd_tmpfs_detached;
-};
-
-#ifndef PAGE_SIZE
-#define PAGE_SIZE 4096
+#if __ELF_NATIVE_CLASS == 64
+#define COREDUMP_ELFCLASS ELFCLASS64
+#else
+#define COREDUMP_ELFCLASS ELFCLASS32
#endif
-#define NUM_THREAD_SPAWN 128
-
+ #ifndef SO_PEERPIDFD_THREAD
+ #define SO_PEERPIDFD_THREAD 87
+ #endif
+
void *do_nothing(void *arg)
{
(void)arg;
With that the two declarations this tag added to coredump_test.h are
gone and coredump_socket_test.c fails to build with implicit
declarations of both helpers until they are declared in
coredump_test_helpers.h. rerere doesn't record this part, it is a
separate change on top of the merge:
diff --git a/tools/testing/selftests/coredump/coredump_test_helpers.h b/tools/testing/selftests/coredump/coredump_test_helpers.h
index 3f2f87837558..e7f0998347ca 100644
--- a/tools/testing/selftests/coredump/coredump_test_helpers.h
+++ b/tools/testing/selftests/coredump/coredump_test_helpers.h
@@ -39,6 +39,7 @@
/* Shared helper function declarations */
void *do_nothing(void *arg);
void crashing_child(void);
+void crashing_child_thread(void);
void crashing_child_sparse(size_t size);
void crashing_child_memory(__u64 task_filter, int fd_addr);
bool find_coredump_segment(int fd, __u64 vaddr, ElfW(Phdr) *segment);
@@ -59,6 +60,7 @@ int create_detached_tmpfs(void);
int create_and_listen_unix_socket(const char *path);
bool set_core_pattern(const char *pattern);
int get_peer_pidfd(int fd);
+int get_peer_pidfd_thread(int fd);
bool get_pidfd_info(int fd_peer_pidfd, struct pidfd_info *info);
/* Protocol helper function declarations */
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907:
Linux 7.3-rc7 (2026-10-11 20:04:55 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.shared.net-next.pidfd
for you to fetch changes up to 96bd708bdab49bea550070d935198ad4f2028a73:
Merge patch series "net: support thread-specific pidfds for send and connect" (2026-10-12 10:58:36 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.shared.net-next.pidfd
Please consider pulling these changes from the signed vfs-7.4-rc1.shared.net-next.pidfd tag.
Thanks!
Christian
----------------------------------------------------------------
Christian Brauner (11):
pid: add helpers to operate on a struct pid array
af_unix: record the pid of the sending thread
net: add SO_PASSPIDFD_THREAD to get a thread-specific SCM_PIDFD
selftests/net: SO_PASSPIDFD_THREAD
net: turn sk_peer_pid into an array indexed by pid type
af_unix: record the pid of the connecting thread
net: add SO_PEERPIDFD_THREAD to get a thread-specific pidfd
selftests/net: SO_PEERPIDFD_THREAD
pidfs: record the coredump on the dumping thread's pid too
selftests/coredump: check the dumping thread's pidfd
Merge patch series "net: support thread-specific pidfds for send and connect"
arch/alpha/include/uapi/asm/socket.h | 4 +
arch/mips/include/uapi/asm/socket.h | 4 +
arch/parisc/include/uapi/asm/socket.h | 4 +
arch/sparc/include/uapi/asm/socket.h | 4 +
fs/coredump.c | 22 +-
fs/pidfs.c | 27 +-
include/linux/coredump.h | 4 +-
include/linux/pid.h | 53 ++
include/linux/pid_types.h | 8 +
include/linux/pidfs.h | 5 +
include/linux/sched/signal.h | 18 +
include/linux/socket.h | 9 +-
include/net/scm.h | 10 +-
include/net/sock.h | 8 +-
include/trace/events/landlock.h | 2 +-
include/uapi/asm-generic/socket.h | 4 +
net/bluetooth/af_bluetooth.c | 6 +-
net/bluetooth/hci_sock.c | 8 +-
net/bluetooth/l2cap_sock.c | 2 +-
net/core/scm.c | 40 +-
net/core/sock.c | 108 ++--
net/unix/af_unix.c | 66 +--
net/unix/af_unix.h | 3 +-
tools/lib/python/kdoc/xforms_lists.py | 1 +
.../selftests/coredump/coredump_socket_test.c | 175 ++++++
tools/testing/selftests/coredump/coredump_test.h | 2 +
.../selftests/coredump/coredump_test_helpers.c | 49 ++
tools/testing/selftests/net/af_unix/Makefile | 2 +
tools/testing/selftests/net/af_unix/scm_pidfd.c | 602 +++++++++++++++++++++
29 files changed, 1137 insertions(+), 113 deletions(-)
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 18/19 for v7.4] vfs shared super
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (16 preceding siblings ...)
2026-10-16 10:26 ` [GIT PULL 17/19 for v7.4] vfs shared net-next pidfd Christian Brauner
@ 2026-10-16 10:26 ` Christian Brauner
2026-10-16 10:27 ` [GIT PULL 19/19 for v7.4] vfs sync_close Christian Brauner
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:26 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This renames vfs_get_super() to get_tree_super() and exports it so a
filesystem that needs its own superblock matching policy can reuse it
instead of open-coding sget_fc() plus fill_super(). erofs uses it to
share a superblock between file-backed mounts. This is a branch shared
with the erofs tree so the change may also reach you through the erofs
pull request.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit fd73f4a6659897191fa0d40695fe370925dd3780:
Linux 7.3-rc3 (2026-09-13 14:38:02 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.shared.super
for you to fetch changes up to ab3c5140acb36ecc02d5408b99aaaa5648f2ba1f:
Merge patch "erofs: share the superblock for file-backed mounts" (2026-10-12 12:47:33 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.shared.super
Please consider pulling these changes from the signed vfs-7.4-rc1.shared.super tag.
Thanks!
Christian
----------------------------------------------------------------
Christian Brauner (1):
Merge patch "erofs: share the superblock for file-backed mounts"
Giuseppe Scrivano (1):
fs: rename vfs_get_super() to get_tree_super() and export it
fs/super.c | 19 +++++++++++++++----
include/linux/fs_context.h | 4 ++++
2 files changed, 19 insertions(+), 4 deletions(-)
^ permalink raw reply [flat|nested] 20+ messages in thread* [GIT PULL 19/19 for v7.4] vfs sync_close
2026-10-16 10:13 [GIT PULL 00/19 for v7.4] v7.4 Christian Brauner
` (17 preceding siblings ...)
2026-10-16 10:26 ` [GIT PULL 18/19 for v7.4] vfs shared super Christian Brauner
@ 2026-10-16 10:27 ` Christian Brauner
18 siblings, 0 replies; 20+ messages in thread
From: Christian Brauner @ 2026-10-16 10:27 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel
Hey Linus,
/* Summary */
This makes closing files synchronous for close_range(), exec and exit.
It is based on the vfs-7.4-rc1.close_range tag and contains it.
Since fput() was switched to task work every final __fput() of an
exiting task is queued on task work and run from exit_task_work(). exec
and close_range() do the same. For a task with a large descriptor table
that is a cmpxchg() and a TIF_NOTIFY_RESUME test-and-set per file plus
a list entry for any later task_work_cancel() to search under pi_lock,
and then a second pass over every struct file that isn't cache hot
anymore by then. Oleg and Neil have pointed this out over the years.
close_files(), close_range() and close-on-exec now flush and put each
file inline the way close(2) does. Kernel threads aren't affected. They
share init_files which init_task pins forever so their exit_files()
never drops the last reference, and their fput() keeps punting to a
workqueue. The one place that could put a table from a kthread context,
a failing copy_process(), can't hold the last reference while the
source table is alive.
On a 64 vCPU KVM guest tearing down 4096, 65536 and 1M descriptors
scattered at random positions in the table:
4096 fds 65536 fds 1M fds
exit 1045 -> 895 us 18.9 -> 14.9 ms 429 -> 306 ms
execve, close-on-exec 1393 -> 1190 us 21.4 -> 16.9 ms 471 -> 325 ms
close_range() 1179 -> 988 us 21.9 -> 17.4 ms 484 -> 337 ms
So that is 16-21% or 40-150 ns per closed file, largest at 1M
descriptors. With eight processes tearing down 65536 descriptors each
at once it stays at 16-21% because the second pass over 16 MB of struct
file is what gets expensive when CPUs compete for the cache. With 32 or
64 processes both kernels are bound by pushing millions of files
through slab and rcu and the difference shrinks to 4-8%. Files whose
own release dominates gain less, 13% for eventfds, 11% for pipes, 6%
for AF_UNIX sockets. close(2) is untouched and will-it-scale is within
2%.
The spufs coredump support is removed. It was the only reason
do_coredump() unshared the descriptor table. gdb dropped Cell debugging
in 9.1 and binutils in 2.34, the Cell blades are gone and nothing on
the PlayStation 3 produces or reads these notes. With that
unshare_files() goes away, exec installs its private table through the
new switch_files_struct() and the coredump startup completion becomes a
plain thread count waited on with the new wait_var_event_state().
Three fixes for the synchronous close are included. A failed fork
released its files under scx_fork_rwsem and deadlocked against the bpf
link's release. A session leader's exit released its tty before
disassociate_ctty() ran and the foreground job lost its SIGHUP, so the
tty is hung up before the files are closed now. And descriptor tables
are walked from the highest descriptor down which restores the order
the deferred puts had and keeps a few long-standing release ordering
bugs from deadlocking exit.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
This conflicts with the vfs-7.4-rc1.coredump tag in fs/coredump.c
between commit 98a2606e32954 ("coredump: clean up coredump state
handling") from that tag and commits c2fe52e23c12a ("coredump: drop
core_state->dumper") and 3f0993fbe42be ("coredump: stop unsharing the
file descriptor table") from this tag. The coredump tag is merged
before this one.
It also conflicts in kernel/fork.c with commits 9cd0df397a119 ("fs:
pass flags to copy_fs()") and d2bdb9b61b427 ("fs: let idle threads
share init_fs") from the vfs-7.3-rc8.fixes pull request and commit
57088a37b2e4d ("fs: put the old fs_struct before the old namespaces in
unshare()") in mainline on one side and commits 296a98c1fa507 ("fork:
release the files of a failed fork after sched_cancel_fork()") and
31116e528f195 ("fs: add switch_files_struct()") from this tag on the
other:
diff --cc fs/coredump.c
index 8074f81c829c,6f4c6a900dc5..000000000000
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@@ -563,9 -557,9 +564,9 @@@ static void coredump_finish(enum coredu
struct task_struct *task;
spin_lock_irq(¤t->sighand->siglock);
- if (core_dumped && !__fatal_signal_pending(current))
+ if ((state & COREDUMP_STATE_STARTED) && !__fatal_signal_pending(current))
current->signal->group_exit_code |= 0x80;
- next = current->signal->core_state->dumper.next;
+ next = current->signal->core_state->tasks;
current->signal->core_state = NULL;
spin_unlock_irq(¤t->sighand->siglock);
@@@ -1228,15 -1116,10 +1229,10 @@@ static void do_coredump(struct core_nam
}
/* Don't even generate the coredump. */
- if (cn->mask & COREDUMP_REJECT)
+ if (cprm->mask & COREDUMP_REJECT)
return;
- /* get us an unshared descriptor table; almost always a no-op */
- /* The cell spufs coredump code reads the file descriptor tables */
- if (unshare_files())
- return;
-
- if ((cn->mask & COREDUMP_KERNEL) && !coredump_write(cn, cprm, binfmt))
+ if ((cprm->mask & COREDUMP_KERNEL) && !coredump_write(cprm, binfmt))
return;
coredump_sock_shutdown(cprm->file);
diff --cc kernel/fork.c
index ebc39f620701,50f5b3e2ca87..000000000000
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@@ -2304,11 -2301,9 +2307,11 @@@ __latent_entropy struct task_struct *co
retval = copy_files(clone_flags, p, args->no_files);
if (retval)
goto bad_fork_cleanup_semundo;
- retval = copy_fs(clone_flags, p, args->umh);
+ retval = copy_fs(clone_flags, p,
+ (args->umh ? COPY_FS_UMH : 0) |
+ (args->idle ? COPY_FS_IDLE : 0));
if (retval)
- goto bad_fork_cleanup_files;
+ goto bad_fork_cleanup_semundo;
retval = copy_sighand(clone_flags, p);
if (retval)
goto bad_fork_cleanup_fs;
@@@ -3339,10 -3305,11 +3324,8 @@@ int ksys_unshare(unsigned long unshare_
new_nsproxy = NULL;
}
- if (new_fd) {
- guard(task_lock)(current);
- swap(current->files, new_fd);
- }
- if (new_fs)
- new_fs = switch_fs_struct(new_fs);
-
+ if (new_fd)
+ switch_files_struct(current, no_free_ptr(new_fd));
if (new_cred) {
/* Install the new user namespace */
Merge conflicts with other trees
================================
This conflicts with the kapi tree in fs/open.c between commit
856d40153ab75 ("kernel/api: add API specification for sys_close") from
the kapi tree and commit 2b256ebe82872 ("fs: add filp_close_sync()")
from this tree. Both add something right below filp_close(). The
resolution keeps filp_close_sync() first and the new kernel-doc block
for sys_close() after it. The kapi side is a 250 line comment so no
diff here.
The following changes since commit fd73f4a6659897191fa0d40695fe370925dd3780:
Linux 7.3-rc3 (2026-09-13 14:38:02 -0700)
are available in the Git repository at:
git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.sync_close
for you to fetch changes up to 02de8d0c3512108620cae8db0c71fe227f1da5bd:
Merge patch series "files: fixes for synchronous close_range(), exec, exit" (2026-10-05 13:11:51 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.sync_close
Please consider pulling these changes from the signed vfs-7.4-rc1.sync_close tag.
Thanks!
Christian
----------------------------------------------------------------
Christian Brauner (32):
file: let dup_fd() leave the punched hole behind
selftests/core: test the hole CLOSE_RANGE_UNSHARE leaves behind
file: rename dup_fd()'s punch_hole to range
file: let dup_fd() drop everything outside of the range
close_range: turn the flags into an enum
file: add CLOSE_RANGE_EXCEPT
selftests/core: test CLOSE_RANGE_EXCEPT
file: let dup_fd() drop only close-on-exec descriptors
file: add CLOSE_RANGE_CLOEXEC_ONLY
selftests/core: test CLOSE_RANGE_CLOEXEC_ONLY
Merge patch series "files,close_range: add CLOSE_RANGE_{CLOEXEC_ONLY,EXCEPT}"
powerpc: remove coredump support
fs: don't open-code file_close_fd() in close_fd()
coredump: stop unsharing the file descriptor table
fs: add switch_files_struct()
Merge patch series "powerpc: remove spufs coredump support"
fs: move unshare_fd() to fs/file.c
fs: remove unshare_files()
fs: add filp_close_sync()
fs: make close_files() synchronous
fs: make close_range() synchronous
fs: rename do_close_on_exec() to close_cloexec_files()
fs: make close_cloexec_files() synchronous
coredump: drop core_state->dumper
sched: add wait_var_event_state()
coredump: replace the startup completion with a thread count
fork: release the files of a failed fork after sched_cancel_fork()
exit: hang up the tty before closing the files
coredump: factor out coredump_wait_inactive()
fs: close files from the highest descriptor down
Merge patch series "files: make closing files synchronous for close_range(), exec, exit"
Merge patch series "files: fixes for synchronous close_range(), exec, exit"
arch/powerpc/Kconfig | 1 -
arch/powerpc/include/asm/elf.h | 6 -
arch/powerpc/include/asm/spu.h | 3 -
arch/powerpc/platforms/cell/Kconfig | 1 -
arch/powerpc/platforms/cell/spu_syscalls.c | 20 -
arch/powerpc/platforms/cell/spufs/Makefile | 1 -
arch/powerpc/platforms/cell/spufs/coredump.c | 183 -----
arch/powerpc/platforms/cell/spufs/file.c | 114 ---
arch/powerpc/platforms/cell/spufs/spufs.h | 12 -
arch/powerpc/platforms/cell/spufs/syscalls.c | 4 -
fs/binfmt_elf.c | 6 +-
fs/binfmt_elf_fdpic.c | 2 +-
fs/coredump.c | 48 +-
fs/exec.c | 13 +-
fs/file.c | 309 ++++++--
fs/internal.h | 1 +
fs/open.c | 17 +-
include/linux/fdtable.h | 14 +-
include/linux/sched/signal.h | 6 +-
include/linux/wait_bit.h | 26 +
include/uapi/linux/close_range.h | 31 +-
kernel/exit.c | 15 +-
kernel/fork.c | 57 +-
tools/testing/selftests/core/close_range_test.c | 951 ++++++++++++++++++++++++
24 files changed, 1313 insertions(+), 528 deletions(-)
delete mode 100644 arch/powerpc/platforms/cell/spufs/coredump.c
^ permalink raw reply [flat|nested] 20+ messages in thread