[GIT PULL for v7.1] vfs fixes

[Christian Brauner]

Hey Linus,

/* Summary */

This contains a fixes for the current development cycle. Note that AI
related review sometimes delays fixes a bit because we find more fixes
for the fixes. I might try and send smaller but more fixes PRs if this
trend keeps up.

- Fix various netfslib bugs

- Fix an out-of-bounds write when listing idmappings.

- Fix the return values in jfs_mkdir() and orangefs_mkdir().

- Fix a writeback writeback array overflow in fuse.

- Fix a forced iversion increment on lazytime timestamp updates

- Reject a negative timeval component in kern_select().

- Fix error return when vfs_mkdir() fails in the cachefiles code.

- Fix wrong error code returned for pidns ioctls.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit 5d6919055dec134de3c40167a490f33c74c12581:

  Linux 7.1-rc3 (2026-05-10 14:08:09 -0700)

are available in the Git repository at:

  git@xxxxxxxxxxxxxxxxxxx:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.1-rc5.fixes

for you to fetch changes up to 8a220d1c312c66194f4a33dd52d1fba42bc2b341:

  cachefiles: Fix error return when vfs_mkdir() fails (2026-05-15 15:32:43 +0200)

----------------------------------------------------------------
vfs-7.1-rc5.fixes

Please consider pulling these changes from the signed vfs-7.1-rc5.fixes tag.

Thanks!
Christian

----------------------------------------------------------------
Breno Leitao (1):
      fs/select: reject negative timeval components in kern_select()

Christian Brauner (1):
      Merge patch series "netfs: Miscellaneous fixes"

David Howells (22):
      netfs: Fix cancellation of a DIO and single read subrequests
      netfs: Fix missing locking around retry adding new subreqs
      netfs: Fix missing barriers when accessing stream->subrequests locklessly
      netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
      netfs: Fix potential for tearing in ->remote_i_size and ->zero_point
      netfs: Fix zeropoint update where i_size > remote_i_size
      netfs: Fix potential uninitialised var in netfs_extract_user_iter()
      netfs: Fix overrun check in netfs_extract_user_iter()
      netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone
      netfs: Defer the emission of trace_netfs_folio()
      netfs: Fix streaming write being overwritten
      netfs: Fix potential deadlock in write-through mode
      netfs: Fix read-gaps to remove netfs_folio from filled folio
      netfs: Fix write streaming disablement if fd open O_RDWR
      netfs: Fix early put of sink folio in netfs_read_gaps()
      netfs: Fix leak of request in netfs_write_begin() error handling
      netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
      netfs: Fix partial invalidation of streaming-write folio
      netfs: Fix folio->private handling in netfs_perform_write()
      netfs: Fix netfs_read_folio() to wait on writeback
      netfs, afs: Fix write skipping in dir/link writepages
      afs: Fix the locking used by afs_get_link()

Hongling Zeng (2):
      fs: Fix return in jfs_mkdir and orangefs_mkdir
      cachefiles: Fix error return when vfs_mkdir() fails

Junxi Qian (1):
      fuse: fix writeback array overflow when max_pages is one

Junyoung Jang (1):
      fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap

Pankaj Raghav (1):
      fs: fix forced iversion increment on lazytime timestamp updates

Paulo Alcantara (1):
      netfs: fix error handling in netfs_extract_user_iter()

Viacheslav Dubeyko (1):
      netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call

Zhihao Cheng (1):
      nsfs: fix wrong error code returned for pidns ioctls

 fs/9p/v9fs_vfs.h             |  13 --
 fs/9p/vfs_inode.c            |   6 +-
 fs/9p/vfs_inode_dotl.c       |  12 +-
 fs/afs/Makefile              |   1 +
 fs/afs/dir.c                 |  79 +++++++-----
 fs/afs/file.c                |  24 +++-
 fs/afs/fsclient.c            |   4 +-
 fs/afs/inode.c               | 127 ++++---------------
 fs/afs/internal.h            |  45 ++++---
 fs/afs/symlink.c             | 278 ++++++++++++++++++++++++++++++++++++++++
 fs/afs/validation.c          |  14 +-
 fs/afs/write.c               |   2 +-
 fs/afs/yfsclient.c           |   4 +-
 fs/cachefiles/namei.c        |   2 +
 fs/fuse/file.c               |   5 +-
 fs/inode.c                   |   8 +-
 fs/jfs/namei.c               |   2 +-
 fs/mnt_idmapping.c           |   2 +
 fs/netfs/buffered_read.c     |  73 ++++++-----
 fs/netfs/buffered_write.c    | 174 ++++++++++++++++---------
 fs/netfs/direct_read.c       |  42 ++----
 fs/netfs/direct_write.c      |   6 +-
 fs/netfs/internal.h          |   3 +
 fs/netfs/iterator.c          |  41 ++++--
 fs/netfs/misc.c              |  41 ++++--
 fs/netfs/read_collect.c      |  19 ++-
 fs/netfs/read_retry.c        |  17 ++-
 fs/netfs/read_single.c       |  23 ++--
 fs/netfs/write_collect.c     |  15 ++-
 fs/netfs/write_issue.c       |  49 ++++---
 fs/netfs/write_retry.c       |   6 +-
 fs/nsfs.c                    |   2 +-
 fs/orangefs/namei.c          |   2 +-
 fs/select.c                  |  11 ++
 fs/smb/client/cifsfs.c       |  38 ++++--
 fs/smb/client/cifssmb.c      |   3 +-
 fs/smb/client/file.c         |  13 +-
 fs/smb/client/inode.c        |  14 +-
 fs/smb/client/readdir.c      |   3 +-
 fs/smb/client/smb2ops.c      |  42 +++---
 fs/smb/client/smb2pdu.c      |   3 +-
 include/linux/list.h         |  37 ++++++
 include/linux/netfs.h        | 295 +++++++++++++++++++++++++++++++++++++++++--
 include/trace/events/netfs.h |   8 ++
 44 files changed, 1171 insertions(+), 437 deletions(-)
 create mode 100644 fs/afs/symlink.c