[PATCH 0/6] fs: fixes for statmount() short buffers and listmount()/listns() cursors

[Christian Brauner <brauner@kernel.org>]

shaos reported two issues in [1] and [2]. Both are real.

- statmount() reserves the empty string in the seq buffer before a
  handler runs but the early return for "nothing emitted" never checks
  that byte against the caller's buffer. So ask for STATMOUNT_MNT_UIDMAP
  on a mount that isn't idmapped with a buffer smaller than struct
  statmount and we write one zero byte past the buffer. It's the
  caller's own memory but that's still not ok. I'm fixing this in
  prepare_kstatmount() where the exact-size check already lives so that
  unset strings keep pointing at an empty string.

- listmount() and listns() add one to the cursor before they look up
  the next entry. With U64_MAX that wraps to zero and the listing starts
  over. No real cursor can ever be U64_MAX so this only bites callers
  that make up cursors but it's still wrong.

All three come with selftests. I've tagged the two cursor fixes for
stable as well since they're trivial but I don't feel strongly about
that.

[1]: https://lore.kernel.org/r/20261020110747.959829-1-shawnq1@163.com
[2]: https://lore.kernel.org/r/20261020110732.959552-1-shawnq1@163.com

---
Christian Brauner (6):
      statmount: don't copy the reserved empty string past the buffer
      selftests/filesystems: check short buffers for statmount() strings
      listmount: don't wrap around with a U64_MAX cursor
      selftests/filesystems: check listmount() with a U64_MAX cursor
      listns: don't wrap around with a U64_MAX cursor
      selftests/namespaces: check listns() with a U64_MAX cursor

 fs/namespace.c                                     |  5 +-
 kernel/nstree.c                                    | 29 ++++------
 .../filesystems/statmount/listmount_test.c         | 11 ++++
 .../filesystems/statmount/statmount_test.c         | 61 +++++++++++++++++++++-
 tools/testing/selftests/namespaces/listns_test.c   | 34 ++++++++++++
 5 files changed, 120 insertions(+), 20 deletions(-)
---
base-commit: 08a7d685fc611140f5d4244abef522b71900c563
change-id: 20261021-work-mount-statmount_listns_fixes-03b0604d7341