[GIT PULL for v7.0] vfs fixes

[Christian Brauner <brauner@kernel.org>]

Hey Linus,

/* Summary */

This contains fixes for this cycle:

- Fix an uninitialized variable in file_getattr(). The flags_valid field
  wasn't initialized before calling vfs_fileattr_get(), triggering KMSAN
  uninit-value reports in fuse.

- Fix writeback wakeup and logging timeouts when DETECT_HUNG_TASK is not
  enabled. sysctl_hung_task_timeout_secs is 0 in that case causing
  spurious "waiting for writeback completion for more than 1 seconds"
  warnings.

- Fix a null-ptr-deref in do_statmount() when the mount is internal.

- Add missing kernel-doc description for the @private parameter in
  iomap_readahead().

- Fix mount namespace creation to hold namespace_sem across the mount
  copy in create_new_namespace(). The previous drop-and-reacquire
  pattern was fragile and failed to clean up mount propagation links if
  the real rootfs was a shared or dependent mount.

- Fix /proc mount iteration where m->index wasn't updated when
  m->show() overflows, causing a restart to repeatedly show the same
  mount entry in a rapidly expanding mount table.

- Return EFSCORRUPTED instead of ENOSPC in minix_new_inode() when the
  inode number is out of range.

- Fix unshare(2) when CLONE_NEWNS is set and current->fs isn't shared.
  copy_mnt_ns() received the live fs_struct so if a subsequent namespace
  creation failed the rollback would leave pwd and root pointing to
  detached mounts. Always allocate a new fs_struct when CLONE_NEWNS is
  requested.

- fserror bug fixes:

  - Remove the unused fsnotify_sb_error() helper now that all callers
    have been converted to fserror_report_metadata.

  - Fix a lockdep splat in fserror_report() where igrab() takes
    inode::i_lock which can be held in IRQ context. Replace igrab() with
    a direct i_count bump since filesystems should not report inodes that
    are about to be freed or not yet exposed.

- Handle error pointer in procfs for try_lookup_noperm().

- Fix an integer overflow in ep_loop_check_proc() where recursive calls
  returning INT_MAX would overflow when +1 is added, breaking the
  recursion depth check.

- Fix a misleading break in pidfs.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

The following changes since commit 770aaedb461a055f79b971d538678942b6607894:

  Merge tag 'bootconfig-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace (2026-02-13 19:33:39 -0800)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.0-rc2.fixes

for you to fetch changes up to 4a1ddb0f1c48c2b56f21d8b5200e2e29adf4c1df:

  pidfs: avoid misleading break (2026-02-24 12:09:00 +0100)

----------------------------------------------------------------
vfs-7.0-rc2.fixes

Please consider pulling these changes from the signed vfs-7.0-rc2.fixes tag.

Thanks!
Christian

----------------------------------------------------------------
Al Viro (1):
      unshare: fix unshare_fs() handling

Christian Brauner (4):
      mount: hold namespace_sem across copy in create_new_namespace()
      namespace: fix proc mount iteration
      Merge patch series "fserror: bug fixes"
      pidfs: avoid misleading break

Darrick J. Wong (2):
      fsnotify: drop unused helper
      fserror: fix lockdep complaint when igrabbing inode

Edward Adam Davis (1):
      fs: init flags_valid before calling vfs_fileattr_get

Ethan Tidmore (1):
      proc: Fix pointer error dereference

Hongbo Li (1):
      iomap: Describe @private in iomap_readahead()

Huacai Chen (1):
      writeback: Fix wakeup and logging timeouts for !DETECT_HUNG_TASK

Jann Horn (1):
      eventpoll: Fix integer overflow in ep_loop_check_proc()

Jori Koolstra (1):
      minix: Correct errno in minix_new_inode

Qing Wang (1):
      statmount: Fix the null-ptr-deref in do_statmount()

 fs/eventpoll.c           |   5 +-
 fs/file_attr.c           |   2 +-
 fs/fs-writeback.c        |   9 ++--
 fs/iomap/buffered-io.c   |   1 +
 fs/iomap/ioend.c         |  46 ++++++++++++++++
 fs/minix/bitmap.c        |   2 +-
 fs/namespace.c           | 133 ++++++++++++++++++++++++++---------------------
 fs/pidfs.c               |  10 ++--
 fs/proc/base.c           |   3 ++
 include/linux/fsnotify.h |  13 -----
 kernel/fork.c            |   2 +-
 11 files changed, 139 insertions(+), 87 deletions(-)