[GIT PULL for v7.0] vfs fixes

[GIT PULL for v7.0] vfs fixes

[Christian Brauner]

Hey Linus,

/* Summary */

This contains fixes for this cycle:

- Fix an uninitialized variable in file_getattr(). The flags_valid field
  wasn't initialized before calling vfs_fileattr_get(), triggering KMSAN
  uninit-value reports in fuse.

- Fix writeback wakeup and logging timeouts when DETECT_HUNG_TASK is not
  enabled. sysctl_hung_task_timeout_secs is 0 in that case causing
  spurious "waiting for writeback completion for more than 1 seconds"
  warnings.

- Fix a null-ptr-deref in do_statmount() when the mount is internal.

- Add missing kernel-doc description for the @private parameter in
  iomap_readahead().

- Fix mount namespace creation to hold namespace_sem across the mount
  copy in create_new_namespace(). The previous drop-and-reacquire
  pattern was fragile and failed to clean up mount propagation links if
  the real rootfs was a shared or dependent mount.

- Fix /proc mount iteration where m->index wasn't updated when
  m->show() overflows, causing a restart to repeatedly show the same
  mount entry in a rapidly expanding mount table.

- Return EFSCORRUPTED instead of ENOSPC in minix_new_inode() when the
  inode number is out of range.

- Fix unshare(2) when CLONE_NEWNS is set and current->fs isn't shared.
  copy_mnt_ns() received the live fs_struct so if a subsequent namespace
  creation failed the rollback would leave pwd and root pointing to
  detached mounts. Always allocate a new fs_struct when CLONE_NEWNS is
  requested.

- fserror bug fixes:

  - Remove the unused fsnotify_sb_error() helper now that all callers
    have been converted to fserror_report_metadata.

  - Fix a lockdep splat in fserror_report() where igrab() takes
    inode::i_lock which can be held in IRQ context. Replace igrab() with
    a direct i_count bump since filesystems should not report inodes that
    are about to be freed or not yet exposed.

- Handle error pointer in procfs for try_lookup_noperm().

- Fix an integer overflow in ep_loop_check_proc() where recursive calls
  returning INT_MAX would overflow when +1 is added, breaking the
  recursion depth check.

- Fix a misleading break in pidfs.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

The following changes since commit 770aaedb461a055f79b971d538678942b6607894:

  Merge tag 'bootconfig-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace (2026-02-13 19:33:39 -0800)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.0-rc2.fixes

for you to fetch changes up to 4a1ddb0f1c48c2b56f21d8b5200e2e29adf4c1df:

  pidfs: avoid misleading break (2026-02-24 12:09:00 +0100)

----------------------------------------------------------------
vfs-7.0-rc2.fixes

Please consider pulling these changes from the signed vfs-7.0-rc2.fixes tag.

Thanks!
Christian

----------------------------------------------------------------
Al Viro (1):
      unshare: fix unshare_fs() handling

Christian Brauner (4):
      mount: hold namespace_sem across copy in create_new_namespace()
      namespace: fix proc mount iteration
      Merge patch series "fserror: bug fixes"
      pidfs: avoid misleading break

Darrick J. Wong (2):
      fsnotify: drop unused helper
      fserror: fix lockdep complaint when igrabbing inode

Edward Adam Davis (1):
      fs: init flags_valid before calling vfs_fileattr_get

Ethan Tidmore (1):
      proc: Fix pointer error dereference

Hongbo Li (1):
      iomap: Describe @private in iomap_readahead()

Huacai Chen (1):
      writeback: Fix wakeup and logging timeouts for !DETECT_HUNG_TASK

Jann Horn (1):
      eventpoll: Fix integer overflow in ep_loop_check_proc()

Jori Koolstra (1):
      minix: Correct errno in minix_new_inode

Qing Wang (1):
      statmount: Fix the null-ptr-deref in do_statmount()

 fs/eventpoll.c           |   5 +-
 fs/file_attr.c           |   2 +-
 fs/fs-writeback.c        |   9 ++--
 fs/iomap/buffered-io.c   |   1 +
 fs/iomap/ioend.c         |  46 ++++++++++++++++
 fs/minix/bitmap.c        |   2 +-
 fs/namespace.c           | 133 ++++++++++++++++++++++++++---------------------
 fs/pidfs.c               |  10 ++--
 fs/proc/base.c           |   3 ++
 include/linux/fsnotify.h |  13 -----
 kernel/fork.c            |   2 +-
 11 files changed, 139 insertions(+), 87 deletions(-)

Re: [GIT PULL for v7.0] vfs fixes

[pr-tracker-bot]

The pull request you sent on Wed, 25 Feb 2026 15:16:23 +0100:

> git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.0-rc2.fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/0e335a7745b0a3e0421d6b4fff718c0deeb130ee

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

[GIT PULL for v7.0] vfs fixes

[Christian Brauner]

Hey Linus,

/* Summary */

This contains a few fixes for this cycle:

- kthread: consolidate kthread exit paths to prevent use-after-free

- iomap: don't mark folio uptodate if read IO has bytes pending

- iomap: don't mark folio uptodate if read IO has bytes pending

- iomap: don't report direct-io retries to fserror

- ns: tighten visibility checks

- netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence

- iomap: reject delalloc mappings during writeback

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

The following changes since commit d9d32e5bd5a4e57675f2b70ddf73c3dc5cf44fc2:

  Merge tag 'ata-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux (2026-02-25 10:41:14 -0800)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.0-rc3.fixes

for you to fetch changes up to d320f160aa5ff36cdf83c645cca52b615e866e32:

  iomap: reject delalloc mappings during writeback (2026-03-04 14:31:56 +0100)

----------------------------------------------------------------
vfs-7.0-rc3.fixes

Please consider pulling these changes from the signed vfs-7.0-rc3.fixes tag.

Thanks!
Christian

----------------------------------------------------------------
Christian Brauner (7):
      kthread: consolidate kthread exit paths to prevent use-after-free
      nsfs: tighten permission checks for ns iteration ioctls
      nsfs: tighten permission checks for handle opening
      nstree: tighten permission checks for listing
      selftests: fix mntns iteration selftests
      Merge patch series "tighten nstree visibility checks"
      Merge patch "iomap: don't mark folio uptodate if read IO has bytes pending"

Darrick J. Wong (2):
      iomap: don't report direct-io retries to fserror
      iomap: reject delalloc mappings during writeback

David Howells (1):
      netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence

Joanne Koong (1):
      iomap: don't mark folio uptodate if read IO has bytes pending

 fs/iomap/buffered-io.c                             |  15 +-
 fs/iomap/direct-io.c                               |  15 +-
 fs/iomap/ioend.c                                   |  13 +-
 fs/netfs/direct_write.c                            | 228 +++++++++++++++++++--
 fs/netfs/internal.h                                |   4 +-
 fs/netfs/write_collect.c                           |  21 --
 fs/netfs/write_issue.c                             |  41 +---
 fs/nsfs.c                                          |  15 +-
 include/linux/kthread.h                            |  21 +-
 include/linux/ns_common.h                          |   2 +
 include/trace/events/netfs.h                       |   4 +-
 kernel/exit.c                                      |   6 +
 kernel/kthread.c                                   |  41 +---
 kernel/nscommon.c                                  |   6 +
 kernel/nstree.c                                    |  29 +--
 .../selftests/filesystems/nsfs/iterate_mntns.c     |  25 ++-
 16 files changed, 326 insertions(+), 160 deletions(-)

Re: [GIT PULL for v7.0] vfs fixes

[pr-tracker-bot]

The pull request you sent on Wed,  4 Mar 2026 23:19:50 +0100:

> git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.0-rc3.fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/0b3bb205808195159be633a8cefb602670e856fb

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

[GIT PULL for v7.0] vfs fixes

[Christian Brauner]

Hey Linus,

Sorry for being late with this. Feel free to delay this after you have
tagged. I didn't get around to sending a pull request earlier
unfortunately as the vfs ci took quite a while to run.

/* Summary */

This contains fixes for this cycle:

- Fix netfs_limit_iter() hitting BUG() when an ITER_KVEC iterator reaches
  it via core dump writes to 9P filesystems. Add ITER_KVEC handling
  following the same pattern as the existing ITER_BVEC code.

- Fix a NULL pointer dereference in the netfs unbuffered write retry path
  when the filesystem (e.g., 9P) doesn't set the prepare_write operation.

- Clear I_DIRTY_TIME in sync_lazytime for filesystems implementing
  ->sync_lazytime. Without this the flag stays set and may cause
  additional unnecessary calls during inode deactivation.

- Increase tmpfs size in mount_setattr selftests. A recent commit bumped
  the ext4 image size to 2 GB but didn't adjust the tmpfs backing store,
  so mkfs.ext4 fails with ENOSPC writing metadata.

- Fix an invalid folio access in iomap when i_blkbits matches the folio
  size but differs from the I/O granularity. The cur_folio pointer would
  not get invalidated and iomap_read_end() would still be called on it
  despite the IO helper owning it.

- Fix hash_name() docstring.

- Fix read abandonment during netfs retry where the subreq variable used
  for abandonment could be uninitialized on the first pass or point to a
  deleted subrequest on later passes.

- Don't block sync for filesystems with no data integrity guarantees. Add
  a SB_I_NO_DATA_INTEGRITY superblock flag replacing the per-inode
  AS_NO_DATA_INTEGRITY mapping flag so sync kicks off writeback but
  doesn't wait for flusher threads. This fixes a suspend-to-RAM hang on
  fuse-overlayfs where the flusher thread blocks when the fuse daemon is
  frozen.

- Fix a lockdep splat in iomap when reads fail. iomap_read_end_io()
  invokes fserror_report() which calls igrab() taking i_lock in hardirq
  context while i_lock is normally held with interrupts enabled. Kick
  failed read handling to a workqueue.

- Remove the redundant netfs_io_stream::front member and use
  stream->subrequests.next instead, fixing a potential issue in the
  direct write code path.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

The following changes since commit d320f160aa5ff36cdf83c645cca52b615e866e32:

  iomap: reject delalloc mappings during writeback (2026-03-04 14:31:56 +0100)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.0-rc6.fixes

for you to fetch changes up to 0e764b9d46071668969410ec5429be0e2f38c6d3:

  netfs: Fix the handling of stream->front by removing it (2026-03-26 15:18:45 +0100)

----------------------------------------------------------------
vfs-7.0-rc6.fixes

Please consider pulling these changes from the signed vfs-7.0-rc6.fixes tag.

Thanks!
Christian

----------------------------------------------------------------
Christian Brauner (1):
      selftests/mount_setattr: increase tmpfs size for idmapped mount tests

Christoph Hellwig (1):
      fs: clear I_DIRTY_TIME in sync_lazytime

Darrick J. Wong (1):
      iomap: fix lockdep complaint when reads fail

David Howells (2):
      netfs: Fix read abandonment during retry
      netfs: Fix the handling of stream->front by removing it

Deepanshu Kartikey (2):
      netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
      netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry

Joanne Koong (2):
      iomap: fix invalid folio access when i_blkbits differs from I/O granularity
      writeback: don't block sync for filesystems with no data integrity guarantees

Jori Koolstra (1):
      vfs: fix docstring of hash_name()

 fs/fs-writeback.c                                  | 36 +++++++++++----
 fs/fuse/file.c                                     |  4 +-
 fs/fuse/inode.c                                    |  1 +
 fs/iomap/bio.c                                     | 51 +++++++++++++++++++++-
 fs/iomap/buffered-io.c                             | 15 ++++---
 fs/namei.c                                         | 10 ++++-
 fs/netfs/buffered_read.c                           |  3 +-
 fs/netfs/direct_read.c                             |  3 +-
 fs/netfs/direct_write.c                            | 15 +++++--
 fs/netfs/iterator.c                                | 43 ++++++++++++++++++
 fs/netfs/read_collect.c                            |  4 +-
 fs/netfs/read_retry.c                              |  5 ++-
 fs/netfs/read_single.c                             |  1 -
 fs/netfs/write_collect.c                           |  4 +-
 fs/netfs/write_issue.c                             |  3 +-
 include/linux/fs/super_types.h                     |  1 +
 include/linux/netfs.h                              |  1 -
 include/linux/pagemap.h                            | 11 -----
 include/trace/events/netfs.h                       |  8 ++--
 .../selftests/mount_setattr/mount_setattr_test.c   |  2 +-
 20 files changed, 168 insertions(+), 53 deletions(-)

Re: [GIT PULL for v7.0] vfs fixes

[pr-tracker-bot]

The pull request you sent on Sun, 29 Mar 2026 23:06:07 +0200:

> git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.0-rc6.fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/d1384f70b2e3162786bc73b8f86c27417803bd57

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

[GIT PULL for v7.0] vfs fixes

[Christian Brauner]

Hey Linus,

/* Summary */

This contains a batch of late-stage fixes for this cycle. The kernfs
rework can also go into during the v7.2 merge window. In which case you
can either just cherry-pick the cachefiles and epoll fix.

The kernfs rbtree is keyed by (hash, ns, name) where the hash is seeded
with the raw namespace pointer via init_name_hash(ns). The resulting
hash values are exposed to userspace through readdir seek positions, and
the pointer-based ordering in kernfs_name_compare() is observable
through entry order.

Switch from raw pointers to ns_common::ns_id for both hashing and
comparison. A preparatory commit first replaces all const void *
namespace parameters with const struct ns_common * throughout
kernfs/sysfs/kobject so the code can access ns->ns_id. Also compare the
ns_id when hashes match in the rbtree to handle crafted collisions.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

The following changes since commit d0c3bcd5b8976159d835a897254048e078f447e6:

  Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux (2026-03-30 13:40:48 -0700)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.0-rc8.fixes

for you to fetch changes up to cb76a81c7cec37bdf525164561b02665cd763421:

  kernfs: make directory seek namespace-aware (2026-04-09 14:36:52 +0200)

----------------------------------------------------------------
vfs-7.0-rc8.fixes

Please consider pulling these changes from the signed vfs-7.0-rc8.fixes tag.

Thanks!
Christian

----------------------------------------------------------------
Christian Brauner (3):
      kernfs: pass struct ns_common instead of const void * for namespace tags
      kernfs: use namespace id instead of pointer for hashing and comparison
      kernfs: make directory seek namespace-aware

NeilBrown (1):
      cachefiles: fix incorrect dentry refcount in cachefiles_cull()

Nicholas Carlini (1):
      eventpoll: defer struct eventpoll free to RCU grace period

 drivers/base/class.c                |  4 +--
 drivers/base/core.c                 |  7 ++--
 drivers/infiniband/core/device.c    |  5 +--
 drivers/infiniband/ulp/srp/ib_srp.c |  7 ++--
 drivers/net/bonding/bond_sysfs.c    |  4 +--
 drivers/net/ipvlan/ipvtap.c         |  5 +--
 drivers/net/macvtap.c               |  5 +--
 fs/cachefiles/namei.c               |  5 +++
 fs/eventpoll.c                      |  6 +++-
 fs/kernfs/dir.c                     | 68 ++++++++++++++++++++++++++-----------
 fs/kernfs/file.c                    |  2 +-
 fs/kernfs/kernfs-internal.h         |  2 +-
 fs/kernfs/mount.c                   |  2 +-
 fs/nfs/sysfs.c                      | 16 +++++----
 fs/sysfs/dir.c                      |  6 ++--
 fs/sysfs/file.c                     |  8 ++---
 fs/sysfs/mount.c                    | 10 +++---
 fs/sysfs/symlink.c                  |  7 ++--
 fs/sysfs/sysfs.h                    |  4 +--
 include/linux/device/class.h        |  6 ++--
 include/linux/kernfs.h              | 40 +++++++++++++---------
 include/linux/kobject.h             |  4 +--
 include/linux/kobject_ns.h          | 13 +++----
 include/linux/netdevice.h           |  4 +--
 include/linux/sysfs.h               | 24 ++++++-------
 include/net/net_namespace.h         |  8 ++---
 lib/kobject.c                       |  8 ++---
 lib/kobject_uevent.c                | 13 ++++---
 net/core/net-sysfs.c                | 50 +++++++++++++--------------
 net/core/net_namespace.c            |  8 ++---
 net/sunrpc/sysfs.c                  | 17 ++++++----
 net/wireless/sysfs.c                |  4 +--
 32 files changed, 216 insertions(+), 156 deletions(-)

Re: [GIT PULL for v7.0] vfs fixes

[pr-tracker-bot]

The pull request you sent on Fri, 10 Apr 2026 17:14:49 +0200:

> git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.0-rc8.fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/7c6c4ed80b874f721bc7c2c937e098c56e37d2f0

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html