[GIT PULL for v7.4] vfs fixes

[Christian Brauner <brauner@kernel.org>]

Hey Linus,

/* Summary */

This contains another round of fixes for the current development cycle:

- inode: Let the shrinker reclaim inodes with I_METADATA_WRITEBACK like
  any other clean inode and have evict() write out what the bit tracks
  unless the inode is being deleted.

  Since v7.3 ext2, ext4 without a journal, fat, udf and minix set
  I_METADATA_WRITEBACK when they copy an inode into its buffer and only
  fsync() and friends clear it again. inode_lru_isolate() took such
  inodes off the LRU expecting something to put them back once the bit
  was gone but nothing ever did. So they couldn't be reclaimed until
  something fsynced them or the filesystem was unmounted. On ext4
  without a journal an atime update was enough to pin an inode, and
  creating 60000 small files in a memory cgroup limited to 96M got the
  task OOM killed after about 43000 of them. Now all 60000 get created.

- dcache:

  * Give d_set_mounted() a seqlock of its own that d_invalidate() waits
    on after unhashing the dentry. Since v6.17 d_set_mounted() doesn't
    bump the seqcount of rename_lock anymore, so a mount racing
    d_invalidate() could end up below the unhashed directory. Nobody
    can reach it there and it pins the subtree until the mount
    namespace goes away. With a FUSE directory 3000 levels deep 151 of
    200 bind mounts racing FUSE_NOTIFY_INVAL_ENTRY ended up there.

  * Only take busy secondary roots off ->s_roots in do_one_tree() so
    that umount waits for a racing eviction of an idle one. Since v7.3
    it didn't, which ended in busy inodes after unmount and an iput()
    on a dead superblock.

  * Make a disconnected dentry a secondary root when the mount on it
    goes away so that umount finds it and waits for its eviction. With
    CAP_DAC_READ_SEARCH such a dentry can be mounted on via
    open_by_handle_at() and move_mount() and umount racing its eviction
    ended the same way.

- splice:

  * Remove pipe buffer stealing as you and David suggested. fuse and
    virtio_console were the only users of ->try_steal() and now always
    copy, as they already did when a steal failed. Stealing took page
    cache folios out of their files and turned pages into page cache
    folios and back. SPLICE_F_GIFT and SPLICE_F_MOVE are still accepted
    and fuse still advertises FUSE_SPLICE_MOVE so servers that ask for
    it mount as before.

  * Clamp a ->write_iter() result that is larger than the iterator in
    iter_file_splice_write() instead of only warning about it.
    Otherwise the pipe releases buffers past its head.

- ns:

  * Allocate the namespace id before calling the namespace_init LSM hook
    that was added this merge window. Landlock now logs the allocated id
    instead of zero when it denies the creation of a namespace.

  * Don't mark the arguments of the namespace_init and namespace_free
    hooks as trusted for bpf LSM programs. Both see namespaces that are
    only partially set up or on their way out.

- proc: Don't let proc_sys_call_handler() report more bytes written than
  it was passed when a cgroup/sysctl bpf program replaced the value with
  a longer one. A splice() into the sysctl file then walked past the
  pipe head.

- coda: Pass the append state of each write on to the container file
  with RWF_APPEND or RWF_NOAPPEND. coda_open() sets O_APPEND on the
  container file after its iocb flags were cached, so an O_APPEND write
  overwrote existing data instead of appending.

- adfs: Reject big directory entries in adfs_fplus_getnext() whose name
  doesn't fit into the name buffer. A crafted image overflowed it on the
  stack.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit 1448959fe3d013ffdb8302d17e4a8fdad2d2da95:

  fs: fix the SEEK_CUR f_lock condition (2026-11-09 16:04:55 +0100)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc3.fixes.2

for you to fetch changes up to 2cca8a6f6ae690755862f5b633125119dcf6bd0c:

  Merge patch series "ns: fixes identifier fixes" (2026-11-11 12:41:49 +0100)

----------------------------------------------------------------
vfs-7.4-rc3.fixes.2

Please consider pulling these changes from the signed vfs-7.4-rc3.fixes.2 tag.

Thanks!
Christian

----------------------------------------------------------------
Cheng Yongkang (2):
      fs/proc: fix the write length returned by proc_sys_call_handler()
      fs/splice: clamp an over-reported write_iter result

Christian Brauner (22):
      ext2: add ext2_inode_block() helper
      ext2: don't read the inode block in ext2_sync_inode_metadata()
      ext4: use sb_find_get_block_nonatomic() in ext4_get_inode_loc_noio()
      ext4: don't read the inode block in ext4_sync_inode_metadata()
      minix: add minix_inode_block() helper
      minix: don't read the inode block in minix_sync_inode_metadata()
      udf: don't allocate the inode block in udf_sync_inode_metadata()
      fs: set I_METADATA_WRITEBACK in mmb_mark_buffer_dirty()
      fs: don't strand I_METADATA_WRITEBACK inodes outside the LRU
      ext2: drop mmb_sync() from ext2_evict_inode()
      ext4: drop mmb_sync() from ext4_evict_inode()
      minix: drop mmb_sync() from minix_evict_inode()
      udf: drop mmb_sync() from udf_evict_inode()
      fat: drop mmb_sync() from fat_evict_inode()
      Merge patch series "fs: reclaim inodes with I_METADATA_WRITEBACK"
      dcache: let d_invalidate() wait for a d_set_mounted() in flight
      Merge patch series "dcache: fixes for mountpoints racing d_invalidate() and umount"
      Merge patch series "splice: remove pipe buffer stealing"
      bpf: don't mark namespace_init and namespace_free arguments as trusted
      ns: allocate the namespace id before the namespace_init hook
      nstree: drop ns_tree_add_raw()
      Merge patch series "ns: fixes identifier fixes"

Hungyu Lin (1):
      coda: honor the append state of each write

HyeongJun An (1):
      fs/adfs: bound directory entry name length in adfs_fplus_getnext()

Josef Bacik (2):
      dcache: wait for a racing eviction of a secondary root
      dcache: let umount find a disconnected ex-mountpoint

Kiryl Shutsemau (Meta) (4):
      virtio_console: copy pipe buffers in splice_write()
      fuse: don't move pipe buffers into the page cache
      splice: remove pipe buffer stealing
      splice: replace nosteal_pipe_buf_ops with default_pipe_buf_ops

 Documentation/admin-guide/LSM/landlock.rst |   5 +-
 Documentation/trace/events-landlock.rst    |   5 +-
 drivers/char/virtio_console.c              |  39 +++-----
 fs/adfs/dir_fplus.c                        |   2 +
 fs/buffer.c                                |  16 +++-
 fs/coda/file.c                             |   3 +-
 fs/dcache.c                                |  44 +++++++--
 fs/ext2/inode.c                            |  63 ++++++++-----
 fs/ext4/inode.c                            |  22 ++---
 fs/fat/inode.c                             |   1 -
 fs/fuse/args.h                             |   1 -
 fs/fuse/dev.c                              | 146 +----------------------------
 fs/fuse/file.c                             |   1 -
 fs/fuse/fuse_dev_i.h                       |   1 -
 fs/inode.c                                 |  13 ++-
 fs/minix/bitmap.c                          |  37 +++++---
 fs/minix/inode.c                           |  18 ++--
 fs/minix/minix.h                           |   1 +
 fs/namespace.c                             |   6 +-
 fs/pipe.c                                  |  43 ---------
 fs/proc/proc_sysctl.c                      |   5 +-
 fs/splice.c                                | 113 +++-------------------
 fs/udf/inode.c                             |  33 +++----
 include/linux/fs/super_types.h             |   2 +-
 include/linux/ns_common.h                  |  16 ++--
 include/linux/nstree.h                     |  29 +-----
 include/linux/pipe_fs_i.h                  |  38 --------
 include/trace/events/landlock.h            |   3 +-
 ipc/namespace.c                            |   3 +-
 kernel/bpf/bpf_lsm.c                       |   2 +
 kernel/nscommon.c                          |   7 +-
 kernel/nstree.c                            |   2 +-
 kernel/watch_queue.c                       |   4 -
 mm/shmem.c                                 |   7 --
 net/core/net_namespace.c                   |   4 +-
 net/core/skbuff.c                          |   2 +-
 security/landlock/ns.c                     |   3 +-
 tools/testing/selftests/landlock/ns_test.c |   7 +-
 38 files changed, 239 insertions(+), 508 deletions(-)