[GIT PULL for v7.1] vfs fixes

[Christian Brauner]

Hey Linus,

/* Summary */

This contains a fixes for the current development cycle:

- Fix error handling in ovl_cache_get().

- Tighten access checks for exited tasks in pidfd_getfd().

- Fix selftests leak in __wait_for_test().

- Limit FUSE_NOTIFY_RETRIEVE to uptodate folios.

- Reject fuse_notify() pagecache ops on directories.

- Clear JOBCTL_PENDING_MASK for caller in zap_other_threads().

- Fix failure to unlock in nfsd4_create_file().

- Fix pointer arithmetic in qnx6 directory iteration.

- Fix UAF due to unlocked ->mnt_ns read in may_decode_fh().

- Avoid potential null folio->mapping deref during iomap error reporting.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit 8a220d1c312c66194f4a33dd52d1fba42bc2b341:

  cachefiles: Fix error return when vfs_mkdir() fails (2026-05-15 15:32:43 +0200)

are available in the Git repository at:

  git@xxxxxxxxxxxxxxxxxxx:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.1-rc7.fixes

for you to fetch changes up to 2eea7f44b9c8b42fd7d3a1a87c06a7cd1b99c327:

  iomap: avoid potential null folio->mapping deref during error reporting (2026-06-04 10:02:56 +0200)

----------------------------------------------------------------
vfs-7.1-rc7.fixes

Please consider pulling these changes from the signed vfs-7.1-rc7.fixes tag.

Thanks!
Christian

----------------------------------------------------------------
Aleksandr Nogikh (1):
      signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()

Arpith Kalaginanavoor (1):
      fs/qnx6: fix pointer arithmetic in directory iteration

Christian Brauner (1):
      pidfd: refuse access to tasks that have started exiting harder

Geliang Tang (1):
      selftests: harness: fix pidfd leak in __wait_for_test

Jann Horn (3):
      fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
      fuse: reject fuse_notify() pagecache ops on directories
      fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()

Joanne Koong (1):
      iomap: avoid potential null folio->mapping deref during error reporting

NeilBrown (1):
      VFS: fix possible failure to unlock in nfsd4_create_file()

Nirmoy Das (1):
      ovl: keep err zero after successful ovl_cache_get()

 fs/fhandle.c                                | 16 ++++++++++++++--
 fs/fuse/dev.c                               | 13 ++++++++++++-
 fs/iomap/buffered-io.c                      | 10 +++++-----
 fs/mount.h                                  | 10 +++++++++-
 fs/namei.c                                  | 10 ++++++++++
 fs/namespace.c                              |  6 +++---
 fs/overlayfs/readdir.c                      |  7 +++----
 fs/qnx6/dir.c                               |  8 ++++----
 kernel/pid.c                                |  8 +++++---
 kernel/signal.c                             |  1 +
 tools/testing/selftests/kselftest_harness.h |  1 +
 11 files changed, 67 insertions(+), 23 deletions(-)