[GIT PULL for v7.1] vfs fixes

[Christian Brauner]

Hey Linus,

/* Summary */

- eventpoll: fix ep_remove() UAF and follow-up cleanup

- fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error

- writeback: Fix use after free in inode_switch_wbs_work_fn()

- fuse: reject oversized dirents in page cache

- fs: aio: reject partial mremap to avoid Null-pointer-dereference error

- nstree: fix func. parameter kernel-doc warnings

- fs: Handle multiply claimed blocks more gracefully with mmb

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit d60bc140158342716e13ff0f8aa65642f43ba053:

  Merge tag 'pwrseq-updates-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux (2026-04-13 20:28:22 -0700)

are available in the Git repository at:

  git@xxxxxxxxxxxxxxxxxxx:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.1-rc1.fixes

for you to fetch changes up to ac8777cc36224b4705d2c6efb10c56135d479b21:

  Merge patch series "eventpoll: fix ep_remove() UAF and follow-up cleanup" (2026-04-24 00:37:04 +0200)

----------------------------------------------------------------
vfs-7.1-rc1.fixes

Please consider pulling these changes from the signed vfs-7.1-rc1.fixes tag.

Thanks!
Christian

----------------------------------------------------------------
Christian Brauner (12):
      eventpoll: use hlist_is_singular_node() in __ep_remove()
      eventpoll: split __ep_remove()
      eventpoll: kill __ep_remove()
      eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
      eventpoll: rename ep_remove_safe() back to ep_remove()
      eventpoll: move epi_fget() up
      eventpoll: fix ep_remove struct eventpoll / struct file UAF
      eventpoll: move f_lock acquisition into ep_remove_file()
      eventpoll: refresh eventpoll_release() fast-path comment
      eventpoll: drop dead bool return from ep_remove_epi()
      eventpoll: drop vestigial epi->dying flag
      Merge patch series "eventpoll: fix ep_remove() UAF and follow-up cleanup"

Jan Kara (2):
      writeback: Fix use after free in inode_switch_wbs_work_fn()
      fs: Handle multiply claimed blocks more gracefully with mmb

Randy Dunlap (1):
      nstree: fix func. parameter kernel-doc warnings

Samuel Page (1):
      fuse: reject oversized dirents in page cache

Zizhi Wo (2):
      fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error
      fs: aio: reject partial mremap to avoid Null-pointer-dereference error

 fs/aio.c                  |   5 +-
 fs/buffer.c               |   9 ++-
 fs/eventpoll.c            | 158 +++++++++++++++++++++++-----------------------
 fs/fs-writeback.c         |  36 ++++++-----
 fs/fuse/readdir.c         |   4 ++
 include/linux/eventpoll.h |  16 +++--
 include/linux/nstree.h    |   6 +-
 7 files changed, 125 insertions(+), 109 deletions(-)