[PATCH 0/2] fs: two mount API fixes

From: fujo

Date: Wed Oct 21 2026 - 13:53:59 EST


Two mount API edge cases reported by shaos, both reproduced on
7.3.0-rc7 (58161ead2) with a small syscall probe run as /init under
QEMU with KASAN:

- statmount(2) with STATMOUNT_MNT_UIDMAP on a mount that is not
idmapped and a short buffer copied the reserved empty string at
offset 512, one byte past the declared bufsize, and returned
success.

- listmount(2) and listns(2) with a U64_MAX cursor wrapped around to
zero and restarted the enumeration at the first entry.

Probe output before:

uidmap buf=100 ret=0 size=101 byte512=0
lm cursor=MAX ret=1 id0=2147483651
ln cursor=MAX ret=8 id0=1 id1=2

after:

uidmap buf=100 ret=-75 (EOVERFLOW) byte512=170
lm cursor=MAX ret=-22 (EINVAL)
ln cursor=MAX ret=-22 (EINVAL)

The in-tree statmount_test (17/17), statmount_test_ns (2/2) and
listmount_test (2/2) pass with both patches applied.

Thanks,
fujo