[GIT PULL 09/19 for v7.4] vfs file
From: Christian Brauner
Date: Fri Oct 16 2026 - 06:26:28 EST
Hey Linus,
/* Summary */
This annotates struct fdtable's fd array with __counted_by_ptr so KASAN
and the fortified functions can bounds check it against max_fds and
adds a KUnit suite for fdtable. A follow-up uses __struct_size() in the
test since sparse doesn't know __builtin_dynamic_object_size().
FD_PREPARE() is simplified. It was built as an ACQUIRE-style guard on
infrastructure that was never needed. The ACQUIRE machinery and
CLASS_INIT() go away, the variable is declared with __cleanup()
directly, struct fd_prepare loses its err field since the fd either
holds the descriptor or the error, and callers get a const pointer to
the guard behind a UNIQUE_ID() name so they can't shadow it. Code
generation is identical.
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
This conflicts with mainline in fs/namespace.c between commit
7253a6ff640df ("namespace: drop the file's reference first in
dissolve_on_fput()") in mainline and commit 64cbb36448ff2 ("file: make
struct fd_prepare const and kill its err field") from this tree:
diff --cc fs/namespace.c
index 59fb227df39f,0f5c00816775..000000000000
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@@ -4701,9 -4544,9 +4701,9 @@@ SYSCALL_DEFINE3(fsmount, int, fs_fd, un
FD_PREPARE(fdf, (flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0,
dentry_open(&new_path, O_PATH, fc->cred));
- if (fdf.err) {
+ if (fdf->fd < 0) {
- dissolve_on_fput(new_path.mnt);
+ dissolve_on_fput(no_free_ptr(new_path.mnt));
- return fdf.err;
+ return fdf->fd;
}
/*
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
git@xxxxxxxxxxxxxxxxxxx:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.file
for you to fetch changes up to fae37d5e3c4e94aef334825ab89f66efcfe489b2:
Merge patch series "file: simplify and harden cleanup handling" (2026-09-23 09:28:02 +0200)
----------------------------------------------------------------
vfs-7.4-rc1.file
Please consider pulling these changes from the signed vfs-7.4-rc1.file tag.
Thanks!
Christian
----------------------------------------------------------------
Bill Wendling (2):
vfs: Annotate struct fdtable's fd field with __counted_by_ptr
vfs: Add KUnit tests for fdtable
Christian Brauner (7):
Merge patch series "vfs: Annotate struct fdtable's fd field with __counted_by_ptr"
vfs: use __struct_size() in the fdtable KUnit test
file: simplify FD_PREPARE()
file: declare the FD_PREPARE() variable with __cleanup() directly
cleanup: remove CLASS_INIT()
file: make struct fd_prepare const and kill its err field
Merge patch series "file: simplify and harden cleanup handling"
arch/powerpc/platforms/cell/spufs/inode.c | 12 +--
drivers/gpio/gpiolib-cdev.c | 18 ++---
drivers/gpu/drm/msm/msm_perfcntr.c | 4 +-
drivers/media/mc/mc-request.c | 8 +-
drivers/misc/ntsync.c | 6 +-
fs/Kconfig | 8 ++
fs/eventfd.c | 4 +-
fs/eventpoll.c | 6 +-
fs/file.c | 12 ++-
fs/namespace.c | 12 +--
fs/nsfs.c | 4 +-
fs/tests/.kunitconfig | 2 +
fs/tests/fdtable_kunit.c | 72 +++++++++++++++++
fs/xfs/xfs_handle.c | 6 +-
include/linux/cleanup.h | 7 --
include/linux/fdtable.h | 2 +-
include/linux/file.h | 130 +++++++++++-------------------
io_uring/mock_file.c | 8 +-
kernel/bpf/bpf_iter.c | 6 +-
kernel/bpf/token.c | 6 +-
mm/userfaultfd.c | 6 +-
net/core/scm.c | 8 +-
net/handshake/netlink.c | 8 +-
net/kcm/kcmsock.c | 6 +-
24 files changed, 204 insertions(+), 157 deletions(-)
create mode 100644 fs/tests/.kunitconfig
create mode 100644 fs/tests/fdtable_kunit.c