The Linux Kernel Mailing List
 help / color / mirror / Atom feed
* [GIT PULL for v7.1] vfs fixes
@ 2026-05-18  7:35 Christian Brauner
  2026-05-18 17:32 ` pr-tracker-bot
  2026-05-18 19:46 ` Nathan Chancellor
  0 siblings, 2 replies; 9+ messages in thread
From: Christian Brauner @ 2026-05-18  7:35 UTC (permalink / raw)
  To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel

Hey Linus,

/* Summary */

This contains a fixes for the current development cycle. Note that AI
related review sometimes delays fixes a bit because we find more fixes
for the fixes. I might try and send smaller but more fixes PRs if this
trend keeps up.

- Fix various netfslib bugs

- Fix an out-of-bounds write when listing idmappings.

- Fix the return values in jfs_mkdir() and orangefs_mkdir().

- Fix a writeback writeback array overflow in fuse.

- Fix a forced iversion increment on lazytime timestamp updates

- Reject a negative timeval component in kern_select().

- Fix error return when vfs_mkdir() fails in the cachefiles code.

- Fix wrong error code returned for pidns ioctls.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit 5d6919055dec134de3c40167a490f33c74c12581:

  Linux 7.1-rc3 (2026-05-10 14:08:09 -0700)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.1-rc5.fixes

for you to fetch changes up to 8a220d1c312c66194f4a33dd52d1fba42bc2b341:

  cachefiles: Fix error return when vfs_mkdir() fails (2026-05-15 15:32:43 +0200)

----------------------------------------------------------------
vfs-7.1-rc5.fixes

Please consider pulling these changes from the signed vfs-7.1-rc5.fixes tag.

Thanks!
Christian

----------------------------------------------------------------
Breno Leitao (1):
      fs/select: reject negative timeval components in kern_select()

Christian Brauner (1):
      Merge patch series "netfs: Miscellaneous fixes"

David Howells (22):
      netfs: Fix cancellation of a DIO and single read subrequests
      netfs: Fix missing locking around retry adding new subreqs
      netfs: Fix missing barriers when accessing stream->subrequests locklessly
      netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
      netfs: Fix potential for tearing in ->remote_i_size and ->zero_point
      netfs: Fix zeropoint update where i_size > remote_i_size
      netfs: Fix potential uninitialised var in netfs_extract_user_iter()
      netfs: Fix overrun check in netfs_extract_user_iter()
      netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone
      netfs: Defer the emission of trace_netfs_folio()
      netfs: Fix streaming write being overwritten
      netfs: Fix potential deadlock in write-through mode
      netfs: Fix read-gaps to remove netfs_folio from filled folio
      netfs: Fix write streaming disablement if fd open O_RDWR
      netfs: Fix early put of sink folio in netfs_read_gaps()
      netfs: Fix leak of request in netfs_write_begin() error handling
      netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
      netfs: Fix partial invalidation of streaming-write folio
      netfs: Fix folio->private handling in netfs_perform_write()
      netfs: Fix netfs_read_folio() to wait on writeback
      netfs, afs: Fix write skipping in dir/link writepages
      afs: Fix the locking used by afs_get_link()

Hongling Zeng (2):
      fs: Fix return in jfs_mkdir and orangefs_mkdir
      cachefiles: Fix error return when vfs_mkdir() fails

Junxi Qian (1):
      fuse: fix writeback array overflow when max_pages is one

Junyoung Jang (1):
      fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap

Pankaj Raghav (1):
      fs: fix forced iversion increment on lazytime timestamp updates

Paulo Alcantara (1):
      netfs: fix error handling in netfs_extract_user_iter()

Viacheslav Dubeyko (1):
      netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call

Zhihao Cheng (1):
      nsfs: fix wrong error code returned for pidns ioctls

 fs/9p/v9fs_vfs.h             |  13 --
 fs/9p/vfs_inode.c            |   6 +-
 fs/9p/vfs_inode_dotl.c       |  12 +-
 fs/afs/Makefile              |   1 +
 fs/afs/dir.c                 |  79 +++++++-----
 fs/afs/file.c                |  24 +++-
 fs/afs/fsclient.c            |   4 +-
 fs/afs/inode.c               | 127 ++++---------------
 fs/afs/internal.h            |  45 ++++---
 fs/afs/symlink.c             | 278 ++++++++++++++++++++++++++++++++++++++++
 fs/afs/validation.c          |  14 +-
 fs/afs/write.c               |   2 +-
 fs/afs/yfsclient.c           |   4 +-
 fs/cachefiles/namei.c        |   2 +
 fs/fuse/file.c               |   5 +-
 fs/inode.c                   |   8 +-
 fs/jfs/namei.c               |   2 +-
 fs/mnt_idmapping.c           |   2 +
 fs/netfs/buffered_read.c     |  73 ++++++-----
 fs/netfs/buffered_write.c    | 174 ++++++++++++++++---------
 fs/netfs/direct_read.c       |  42 ++----
 fs/netfs/direct_write.c      |   6 +-
 fs/netfs/internal.h          |   3 +
 fs/netfs/iterator.c          |  41 ++++--
 fs/netfs/misc.c              |  41 ++++--
 fs/netfs/read_collect.c      |  19 ++-
 fs/netfs/read_retry.c        |  17 ++-
 fs/netfs/read_single.c       |  23 ++--
 fs/netfs/write_collect.c     |  15 ++-
 fs/netfs/write_issue.c       |  49 ++++---
 fs/netfs/write_retry.c       |   6 +-
 fs/nsfs.c                    |   2 +-
 fs/orangefs/namei.c          |   2 +-
 fs/select.c                  |  11 ++
 fs/smb/client/cifsfs.c       |  38 ++++--
 fs/smb/client/cifssmb.c      |   3 +-
 fs/smb/client/file.c         |  13 +-
 fs/smb/client/inode.c        |  14 +-
 fs/smb/client/readdir.c      |   3 +-
 fs/smb/client/smb2ops.c      |  42 +++---
 fs/smb/client/smb2pdu.c      |   3 +-
 include/linux/list.h         |  37 ++++++
 include/linux/netfs.h        | 295 +++++++++++++++++++++++++++++++++++++++++--
 include/trace/events/netfs.h |   8 ++
 44 files changed, 1171 insertions(+), 437 deletions(-)
 create mode 100644 fs/afs/symlink.c

^ permalink raw reply	[flat|nested] 9+ messages in thread
* [GIT PULL for v7.1] vfs fixes
@ 2026-06-06 13:17 Christian Brauner
  2026-06-06 23:09 ` pr-tracker-bot
  0 siblings, 1 reply; 9+ messages in thread
From: Christian Brauner @ 2026-06-06 13:17 UTC (permalink / raw)
  To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel

Hey Linus,

/* Summary */

This contains a fixes for the current development cycle:

- Fix error handling in ovl_cache_get().

- Tighten access checks for exited tasks in pidfd_getfd().

- Fix selftests leak in __wait_for_test().

- Limit FUSE_NOTIFY_RETRIEVE to uptodate folios.

- Reject fuse_notify() pagecache ops on directories.

- Clear JOBCTL_PENDING_MASK for caller in zap_other_threads().

- Fix failure to unlock in nfsd4_create_file().

- Fix pointer arithmetic in qnx6 directory iteration.

- Fix UAF due to unlocked ->mnt_ns read in may_decode_fh().

- Avoid potential null folio->mapping deref during iomap error reporting.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit 8a220d1c312c66194f4a33dd52d1fba42bc2b341:

  cachefiles: Fix error return when vfs_mkdir() fails (2026-05-15 15:32:43 +0200)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.1-rc7.fixes

for you to fetch changes up to 2eea7f44b9c8b42fd7d3a1a87c06a7cd1b99c327:

  iomap: avoid potential null folio->mapping deref during error reporting (2026-06-04 10:02:56 +0200)

----------------------------------------------------------------
vfs-7.1-rc7.fixes

Please consider pulling these changes from the signed vfs-7.1-rc7.fixes tag.

Thanks!
Christian

----------------------------------------------------------------
Aleksandr Nogikh (1):
      signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()

Arpith Kalaginanavoor (1):
      fs/qnx6: fix pointer arithmetic in directory iteration

Christian Brauner (1):
      pidfd: refuse access to tasks that have started exiting harder

Geliang Tang (1):
      selftests: harness: fix pidfd leak in __wait_for_test

Jann Horn (3):
      fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
      fuse: reject fuse_notify() pagecache ops on directories
      fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()

Joanne Koong (1):
      iomap: avoid potential null folio->mapping deref during error reporting

NeilBrown (1):
      VFS: fix possible failure to unlock in nfsd4_create_file()

Nirmoy Das (1):
      ovl: keep err zero after successful ovl_cache_get()

 fs/fhandle.c                                | 16 ++++++++++++++--
 fs/fuse/dev.c                               | 13 ++++++++++++-
 fs/iomap/buffered-io.c                      | 10 +++++-----
 fs/mount.h                                  | 10 +++++++++-
 fs/namei.c                                  | 10 ++++++++++
 fs/namespace.c                              |  6 +++---
 fs/overlayfs/readdir.c                      |  7 +++----
 fs/qnx6/dir.c                               |  8 ++++----
 kernel/pid.c                                |  8 +++++---
 kernel/signal.c                             |  1 +
 tools/testing/selftests/kselftest_harness.h |  1 +
 11 files changed, 67 insertions(+), 23 deletions(-)

^ permalink raw reply	[flat|nested] 9+ messages in thread
* [GIT PULL for v7.1] vfs fixes
@ 2026-04-23 22:46 Christian Brauner
  2026-04-24  0:13 ` pr-tracker-bot
  0 siblings, 1 reply; 9+ messages in thread
From: Christian Brauner @ 2026-04-23 22:46 UTC (permalink / raw)
  To: Linus Torvalds; +Cc: Christian Brauner, linux-fsdevel, linux-kernel

Hey Linus,

/* Summary */

- eventpoll: fix ep_remove() UAF and follow-up cleanup

- fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error

- writeback: Fix use after free in inode_switch_wbs_work_fn()

- fuse: reject oversized dirents in page cache

- fs: aio: reject partial mremap to avoid Null-pointer-dereference error

- nstree: fix func. parameter kernel-doc warnings

- fs: Handle multiply claimed blocks more gracefully with mmb

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit d60bc140158342716e13ff0f8aa65642f43ba053:

  Merge tag 'pwrseq-updates-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux (2026-04-13 20:28:22 -0700)

are available in the Git repository at:

  git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.1-rc1.fixes

for you to fetch changes up to ac8777cc36224b4705d2c6efb10c56135d479b21:

  Merge patch series "eventpoll: fix ep_remove() UAF and follow-up cleanup" (2026-04-24 00:37:04 +0200)

----------------------------------------------------------------
vfs-7.1-rc1.fixes

Please consider pulling these changes from the signed vfs-7.1-rc1.fixes tag.

Thanks!
Christian

----------------------------------------------------------------
Christian Brauner (12):
      eventpoll: use hlist_is_singular_node() in __ep_remove()
      eventpoll: split __ep_remove()
      eventpoll: kill __ep_remove()
      eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
      eventpoll: rename ep_remove_safe() back to ep_remove()
      eventpoll: move epi_fget() up
      eventpoll: fix ep_remove struct eventpoll / struct file UAF
      eventpoll: move f_lock acquisition into ep_remove_file()
      eventpoll: refresh eventpoll_release() fast-path comment
      eventpoll: drop dead bool return from ep_remove_epi()
      eventpoll: drop vestigial epi->dying flag
      Merge patch series "eventpoll: fix ep_remove() UAF and follow-up cleanup"

Jan Kara (2):
      writeback: Fix use after free in inode_switch_wbs_work_fn()
      fs: Handle multiply claimed blocks more gracefully with mmb

Randy Dunlap (1):
      nstree: fix func. parameter kernel-doc warnings

Samuel Page (1):
      fuse: reject oversized dirents in page cache

Zizhi Wo (2):
      fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error
      fs: aio: reject partial mremap to avoid Null-pointer-dereference error

 fs/aio.c                  |   5 +-
 fs/buffer.c               |   9 ++-
 fs/eventpoll.c            | 158 +++++++++++++++++++++++-----------------------
 fs/fs-writeback.c         |  36 ++++++-----
 fs/fuse/readdir.c         |   4 ++
 include/linux/eventpoll.h |  16 +++--
 include/linux/nstree.h    |   6 +-
 7 files changed, 125 insertions(+), 109 deletions(-)

^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2026-06-06 23:09 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-18  7:35 [GIT PULL for v7.1] vfs fixes Christian Brauner
2026-05-18 17:32 ` pr-tracker-bot
2026-05-18 19:46 ` Nathan Chancellor
2026-05-18 21:05   ` David Howells
2026-05-18 21:32     ` Nathan Chancellor
  -- strict thread matches above, loose matches on Subject: below --
2026-06-06 13:17 Christian Brauner
2026-06-06 23:09 ` pr-tracker-bot
2026-04-23 22:46 Christian Brauner
2026-04-24  0:13 ` pr-tracker-bot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox