[GIT PULL for v7.2] vfs fixes
From: Christian Brauner
Date: Fri Jul 03 2026 - 07:32:20 EST
Hey Linus,
/* Summary */
This contains fixes for the current development cycle:
- netfs:
* the decision when to disallow write-streaming with fscache in use,
handling of asynchronous cache object creation, a double fput in
cachefiles, clearing S_KERNEL_FILE without the inode lock held, page
extraction bugs in the iov_iter helpers (a potential underflow, a
missing allocation failure check, a memory leak, and a folio offset
miscalculation), writeback error and ENOMEM handling, DIO write
retry for filesystems without a ->prepare_write() method, and the
replacement of the wb_lock mutex with a bit lock plus writethrough
collection offload so that multiple asynchronous writebacks don't
interfere with each other.
* Fix the barriering when walking the netfs subrequest list during
retries as it was possible to see a subrequest that was just added
by the application thread.
- iomap:
* Change iomap to submit read bios after each extent instead of
building them up across extents. The old behavior was considered
problematic for a while and now caused an actual erofs bug.
* Guard the ioend io_size EOF trim in iomap against underflow
when a concurrent truncate moves EOF below the start of the ioend,
wrapping io_size to a huge value.
- overlayfs
* Fix a stale overlayfs comment about the locking order.
* Store the linked-in upper dentry instead of the disconnected
O_TMPFILE dentry during overlayfs tmpfile copy-up. With a FUSE or
virtiofs upper layer ->d_revalidate() would try to look up "/" in
the workdir and fail, causing persistent ESTALE errors that broke
dpkg and apt.
- vfs-bpf: Have the bpf_real_data_inode() kfunc take a struct file
instead of a dentry so it is usable from the bprm_check_security,
mmap_file, and file_mprotect hooks, and rename it from
bpf_real_inode() to make the data-inode semantics explicit. The kfunc
landed this cycle so the change is safe.
- afs: NULL pointer dereferences in the callback
service and in afs_get_tree(), several memory and refcount leaks,
missing locking around the dynamic root inode numbers and premature
cell exposure through /afs, a netns destruction hang caused by a
misplaced increment of net->cells_outstanding, a bulk lookup
malfunction caused by the dir_emit() API change, inode
(re)initialisation issues, and assorted smaller fixes to error codes,
seqlock handling, and debug output.
- vfs: Refuse O_TMPFILE creation with an unmapped fsuid or fsgid and add
a selftest for it.
- Add Jori Koolstra as vboxsf maintainer, taking over from Hans de
Goede.
- Release the pages attached to a short atomic dio bio; the REQ_ATOMIC
size check error path leaked them.
- procfs: Only bump the parent directory link count when registering
directories in procfs. Registering regular files inflated the count
and leaked a link on every create and remove cycle.
- minix: Avoid an unsigned overflow in the minix bitmap block count
calculation that let crafted images with huge inode or zone counts
pass superblock validation and crash the kernel during mount.
- cachefiles: Fix a double unlock in the cachefiles nomem_d_alloc error path
left over from the start_creating() conversion.
- fat: Stop fat from reading directory entries past the 0x00
end-of-directory marker. If the trailing on-disk slots aren't
zero-filled the driver surfaced arbitrary garbage as directory
entries.
- freexvfs: Don't BUG() on unknown typed-extent types in freevxfs, reachable
via ioctl(FIBMAP) on a crafted image; fail with an I/O error instead.
- orangefs: Keep the readdir entry size 64-bit in orangefs fill_from_part().
Truncating it to __u32 bypassed the bounds check and led to out-of-bounds
reads triggerable by the userspace client.
- xfs: Fix the error unwind in xfs_open_devices() which released the rt
device file twice and left dangling buftarg pointers behind that were
freed again when the failed mount was torn down.
- exec: Fix an off-by-one in the comment documenting the maximum binfmt
rewrite depth in exec_binprm(). The code allows five rewrites, not
four; restricting the code would break userspace so the comment is
fixed instead.
- file handles: Reject detached mounts in capable_wrt_mount(). A
detached mount can be dissolved concurrently, leaving a NULL mount
namespace that open_by_handle_at() would dereference.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
No known conflicts.
The following changes since commit 665159e246749578d4e4bfe106ee3b74edcdab18:
Merge tag 'probes-fixes-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace (2026-06-30 17:50:44 -1000)
are available in the Git repository at:
git@xxxxxxxxxxxxxxxxxxx:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.2-rc2.fixes
for you to fetch changes up to 5c6ce05e406520290c1d89da97fb3cd70c09137d:
netfs: Fix barriering when walking subrequest list (2026-07-03 11:52:41 +0200)
----------------------------------------------------------------
vfs-7.2-rc2.fixes
Please consider pulling these changes from the signed vfs-7.2-rc2.fixes tag.
Thanks!
Christian
----------------------------------------------------------------
Alan Urmancheev (1):
exec: fix off-by-one in binfmt max rewrite depth comment
Amir Goldstein (1):
ovl: fix comment about locking order
Bryam Vargas (1):
orangefs: keep the readdir entry size 64-bit in fill_from_part()
Christian Brauner (8):
fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
selftests/filesystems: test O_TMPFILE creation on idmapped mounts
Merge patch series "fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid"
Merge patch series "afs: Miscellaneous fixes"
bpf: have bpf_real_data_inode() take a struct file
xfs: fix the error unwind in xfs_open_devices()
Merge patch series "netfs: Miscellaneous fixes"
Merge patch series "iomap: consolidate bio submission"
Christoph Hellwig (2):
iomap: consolidate bio submission
iomap: submit read bio after each extent
Dan Carpenter (1):
afs: Fix error code in afs_extract_vl_addrs()
David Howells (31):
afs: Fix double netfs initialisation in afs_root_iget()
afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints
afs: Fix directory inode initialisation order
afs: Fix bulk lookup malfunction due to change in dir_emit() API
afs: Fix misplaced inc of net->cells_outstanding
afs: Fix reinitialisation of the inode, in particular ->lock_work
afs: Fix callback service message parsers to pass through -EAGAIN
afs: Use scoped_seqlock_read() rather than manually doing seqlock stuff
afs: Fix missing NULL pointer check in afs_break_some_callbacks()
afs: Fix leak of ungot volume
afs: Fix vllist leak
afs: Fix lack of locking around modifications of net->cells_dyn_ino
afs: Fix premature cell exposure through /afs
afs: Fix the volume AFS_VOLUME_RM_TREE is set on
afs: Fix unchecked-length string display in debug statement
netfs: Fix decision whether to disallow write-streaming due to fscache use
netfs: Fix netfs_create_write_req() to handle async cache object creation
cachefiles: Fix double fput
cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE
iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages()
iov_iter: Fix missing alloc fail check in iov_iter_extract_bvec_pages()
iov_iter: Fix a memory leak in iov_iter_extract_user_pages()
iov_iter: Remove unused variable in kunit_iov_iter.c
scatterlist: Fix offset in folio calc in extract_xarray_to_sg()
netfs: Fix kdoc warning
netfs: Replace wb_lock with a bit lock for asynchronicity
netfs: Fix writethrough to use collection offload
netfs: Fix writeback error handling
netfs: Fix folio state after ENOMEM whilst under writeback iteration
netfs: Fix DIO write retry for filesystems without a ->prepare_write()
netfs: Fix barriering when walking subrequest list
David Lee (1):
fhandle: reject detached mounts in capable_wrt_mount()
Farhad Alemi (1):
freevxfs: don't BUG() on unknown typed-extent type
Fengnan Chang (1):
iomap: release pages on atomic dio size mismatch
Hongling Zeng (1):
cachefiles: Fix double unlock in nomem_d_alloc error path
Joanne Koong (1):
fuse: call fuse_send_readpages explicitly from fuse_readahead
Jori Koolstra (1):
MAINTAINERS: take over vboxsf from Hans de Goede
Krzysztof Wilczyński (1):
proc: only bump parent nlink when registering directories
Li RongQing (1):
afs: Remove erroneous seq |= 1 in volume lookup loop
Matteo Croce (1):
fat: stop reading directory entries past the end-of-directory marker
Matvey Kovalev (1):
afs: fix NULL pointer dereference in afs_get_tree()
Michael Bommarito (1):
minix: avoid overflow in bitmap block count calculation
Morduan Zang (1):
iomap: guard io_size EOF trim against concurrent truncate underflow
Nan Li (1):
afs: handle CB.InitCallBackState3 requests without a server record
Souvik Banerjee (1):
ovl: use linked upper dentry in copy-up tmpfile
Yuto Ohnuki (1):
afs: check for duplicate servers in VL server list
Zilin Guan (1):
afs: use kvfree() to free memory allocated by kvcalloc()
MAINTAINERS | 2 +-
fs/afs/callback.c | 17 +--
fs/afs/cell.c | 27 +++-
fs/afs/cmservice.c | 7 +-
fs/afs/dir.c | 40 +++--
fs/afs/dynroot.c | 2 +-
fs/afs/fs_operation.c | 2 +-
fs/afs/inode.c | 15 +-
fs/afs/internal.h | 3 +-
fs/afs/super.c | 5 +-
fs/afs/symlink.c | 4 +-
fs/afs/vl_list.c | 24 ++-
fs/afs/volume.c | 2 +-
fs/bpf_fs_kfuncs.c | 23 +--
fs/cachefiles/namei.c | 4 +-
fs/exec.c | 2 +-
fs/exfat/iomap.c | 5 +-
fs/fat/dir.c | 44 +++++-
fs/fhandle.c | 2 +-
fs/freevxfs/vxfs_bmap.c | 3 +-
fs/fuse/file.c | 14 +-
fs/iomap/bio.c | 15 +-
fs/iomap/buffered-io.c | 16 +-
fs/iomap/direct-io.c | 7 +-
fs/iomap/ioend.c | 8 +-
fs/minix/minix.h | 2 +-
fs/namei.c | 4 +
fs/netfs/buffered_read.c | 2 +-
fs/netfs/buffered_write.c | 2 +-
fs/netfs/direct_write.c | 18 +--
fs/netfs/internal.h | 12 ++
fs/netfs/locking.c | 95 ++++++++++++
fs/netfs/read_retry.c | 7 +-
fs/netfs/write_collect.c | 10 ++
fs/netfs/write_issue.c | 55 +++----
fs/netfs/write_retry.c | 7 +-
fs/ntfs/aops.c | 6 +-
fs/ntfs3/inode.c | 5 +-
fs/orangefs/dir.c | 7 +-
fs/overlayfs/copy_up.c | 12 +-
fs/overlayfs/inode.c | 4 +-
fs/proc/generic.c | 9 +-
fs/xfs/xfs_aops.c | 3 +-
fs/xfs/xfs_super.c | 3 +
include/linux/iomap.h | 2 +
include/linux/netfs.h | 13 +-
lib/iov_iter.c | 20 ++-
lib/scatterlist.c | 1 +
lib/tests/kunit_iov_iter.c | 5 +-
tools/testing/selftests/filesystems/.gitignore | 1 +
tools/testing/selftests/filesystems/Makefile | 4 +
.../selftests/filesystems/idmapped_tmpfile.c | 168 +++++++++++++++++++++
52 files changed, 592 insertions(+), 178 deletions(-)
create mode 100644 tools/testing/selftests/filesystems/idmapped_tmpfile.c