[GIT PULL 12/18 for v7.3] vfs misc
From: Christian Brauner
Date: Fri Aug 14 2026 - 09:14:48 EST
Hey Linus,
/* Summary */
- The lockref dead-count handling is tidied up. The open-coded check for
a count below zero as the dead marker relies on information the caller should
not have.
- make put_mnt_ns() leave mounts connected. Destroying a mount namespace
disconnected its mounts from their mount points. So a file descriptor still
open on the parent of a mount point could be used to peek under it.
Locked mounts were already kept connected to prevent exactly that. But a
mount is only locked when its tree is copied across a user namespace
boundary. So a mount namespace set up by a privileged component had no locked
mounts and its mounts were disconnected. Passing UMOUNT_CONNECTED keeps every
mount connected and prevents that bug.
- vfs_prepare_mode() passes S_IFDIR for directories. I meant to fix that ago
but didn't get to it. So now someone finally did it. That kills the exception
where the could be 0 when a directory was created whereas every other
creation operation passed it explicitly already.
- move long delayed work for ufs, jffs2, hfsplus, hfs and affs from the
per-cpu system_long_wq to the new unbound system_dfl_long_wq. None of that
work relies on per-cpu state and the work item is enqueued with
queue_delayed_work() whose timer is global anyway. So it may as well benefit
from scheduler task placement.
/* Smaller fixes and cleanups */
- unlock_buffer() and journal_end_buffer_io_sync() use clear_and_wake_up_bit()
- the pipe page pools are unified into a single per-pipe pool and the extra
wake_up(rd_wait) is limited to EPOLLET consumers
- eventpoll now computes its timer slack lazily in ep_poll()
- shrink_dcache_for_umount() keeps making progress on busy roots
- excess xarray nodes are freed in clear_inode()
- romfs detects hard link cycles
- the user path of nested backing files is fixed
- pidfd holds exec_update_lock around the namespace ioctl
- non-memcg-aware nr_cached_objects is skipped during memcg slab shrink
- iomap_write_iter() always returns status
- mangle_path() is renamed to seq_mangle_path()
- inode timestamp accessors are annotated
- new regression test for pipe->poll_usage.
- a few documentation, kernel-doc and selftest fixes
/* Testing */
No build failures or warnings were observed.
/* Conflicts */
Merge conflicts with mainline
=============================
No known conflicts.
Merge conflicts with other trees
================================
[1]: https://lore.kernel.org/linux-next/amnyXEARrAoFoPAj@xxxxxxxxxxxxx
This conflicts with the gfs2 tree in two places. Both are caused by
commit 91e27ed8a387c ("lockref: tidy up dead count handling") from
this tree, which renames __lockref_is_dead() to lockref_is_dead() and
converts all callers, including the ones in gfs2.
The first conflict is in fs/gfs2/glock.c against commit da26828b82a45
("gfs2: Remove the glock lru list and shrinker"). Reported in [1].
[2]: https://lore.kernel.org/linux-next/an208OpVMNEI2Zfo@xxxxxxxxxxxxx
The second conflict is in fs/gfs2/lock_dlm.c against commit
657e5af4fe0b9 ("gfs2: harden gfs2_glock_hold").
The following changes since commit dc59e4fea9d83f03bad6bddf3fa2e52491777482:
Linux 7.2-rc1 (2026-06-28 12:01:31 -0700)
are available in the Git repository at:
git@xxxxxxxxxxxxxxxxxxx:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.3-rc1.misc
for you to fetch changes up to dcacab904fe78d60840ba947a104993ee9ded887:
selftests/namespaces: Fix racy pipe handshake in timens and pidns_separate (2026-08-13 12:20:42 +0200)
----------------------------------------------------------------
vfs-7.3-rc1.misc
Please consider pulling these changes from the signed vfs-7.3-rc1.misc tag.
Thanks!
Christian
----------------------------------------------------------------
Agatha Isabelle Moreira (2):
fs: buffer: use clear_and_wake_up_bit() in unlock_buffer()
fs: jbd2: use clear_and_wake_up_bit() in journal_end_buffer_io_sync()
Amin Vakil (1):
selftests: proc: include fcntl.h in proc-pidns
Baokun Li (1):
fs: fix user path of nested backing files
Ben Dooks (1):
fs: nullfs should include mount.h
Breno Leitao (1):
fs/pipe: unify the page pools into a single per-pipe pool
Brian Foster (1):
iomap: always return status from iomap_write_iter
Chen Linxuan (1):
pidfd: hold exec_update_lock around namespace ioctl
Christian Brauner (5):
Merge patch series "fs: refactor code to use clear_and_wake_up_bit()"
Merge patch series "vfs: pass S_IFDIR mode to vfs_prepare_mode()"
Merge patch series "fs: Move long delayed work on system_dfl_long_wq"
Merge patch series "put_mnt_ns(): leave mounts connected"
Merge patch series "lockref tidy ups + touch ups to it's usage by dcache"
Jann Horn (1):
fs: document semantics of kstat::{uid,gid} fields
Johannes Berg (1):
seq_file: rename mangle_path to seq_mangle_path
Jori Koolstra (31):
vfs: pass S_IFDIR mode to vfs_prepare_mode()
9p: drop redundant S_IFDIR from mkdir
affs: drop redundant S_IFDIR from mkdir
afs: drop redundant S_IFDIR from mkdir
autofs: drop redundant S_IFDIR from mkdir
btrfs: drop redundant S_IFDIR from mkdir
ceph: drop redundant S_IFDIR from mkdir
ext2: drop redundant S_IFDIR from mkdir
ext4: drop redundant S_IFDIR from mkdir
f2fs: drop redundant S_IFDIR from mkdir
gfs2: drop redundant S_IFDIR from mkdir
hfs: drop redundant S_IFDIR from mkdir
hfsplus: drop redundant S_IFDIR from mkdir
hpfs: drop redundant S_IFDIR from mkdir
hugetlbfs: drop redundant S_IFDIR from mkdir
jffs2: drop redundant S_IFDIR from mkdir
jfs: drop redundant S_IFDIR from mkdir
minix: drop redundant S_IFDIR from mkdir
nilfs2: drop redundant S_IFDIR from mkdir
ntfs3: drop redundant S_IFDIR from mkdir
ocfs2: drop redundant S_IFDIR from mkdir
ocfs2: dlmfs: drop redundant S_IFDIR from mkdir
omfs: drop redundant S_IFDIR from mkdir
orangefs: drop redundant S_IFDIR from mkdir
ramfs: drop redundant S_IFDIR from mkdir
udf: drop redundant S_IFDIR from mkdir
ufs: drop redundant S_IFDIR from mkdir
nfs: drop redundant S_IFDIR from mkdir
ubifs: drop redundant S_IFDIR from mkdir
xfs: drop redundant S_IFDIR from mkdir
ntfs: drop redundant S_IFDIR from mkdir
Karl Mehltretter (1):
dcache: keep shrink_dcache_for_umount() making progress on busy roots
Luis Henriques (1):
posix_acl: remove useless code
Malaya Kumar Rout (1):
selftests/statmount: Fix file descriptor leak in setup_namespace
Manush Prajwal (1):
fs: fix switch/case indentation in sysfs() syscall
Marco Crivellari (5):
ufs: Move long delayed work on system_dfl_long_wq
fs/jffs2: Move long delayed work on system_dfl_long_wq
hfsplus: Move long delayed work on system_dfl_long_wq
hfs: Move long delayed work on system_dfl_long_wq
affs: Move long delayed work on system_dfl_long_wq
Mateusz Guzik (2):
lockref: tidy up dead count handling
dcache: use lockref routines for dead count checks
Matthew Wilcox (Oracle) (1):
fs: Free any excess xarray nodes in clear_inode()
Noah Orlando (2):
put_mnt_ns(): leave mounts connected
selftests/filesystems: add mntns cleanup test
Oleg Nesterov (2):
pipe: only enable the extra wake_up(rd_wait) for EPOLLET consumers
selftests/epoll: add a regression test for pipe->poll_usage
Randy Dunlap (1):
nstree: add/fix struct ns_id_req kernel-doc member fields
Ricardo B. Marlière (SUSE) (1):
selftests/namespaces: Fix racy pipe handshake in timens and pidns_separate
Shivank Sharma (1):
initramfs: fix typo in reserve_initrd_mem comment
Usama Arif (2):
fs/super: skip non-memcg-aware nr_cached_objects in memcg slab shrink
eventpoll: compute timer slack lazily in ep_poll()
Wang Yan (1):
selftests/filesystems: fix spelling error in statmount test comment
Yichong Chen (1):
fs: remove stale inode_insert5() kernel-doc parameter
Yu Peng (1):
fs: annotate inode timestamp accessors
Yuhong Cheng (1):
docs: filesystems: porting: fix spelling of returned and instead
이상호 (1):
romfs: detect hard link cycles
Documentation/filesystems/porting.rst | 2 +-
fs/9p/vfs_inode.c | 2 +-
fs/9p/vfs_inode_dotl.c | 1 -
fs/affs/namei.c | 2 +-
fs/affs/super.c | 2 +-
fs/afs/dir.c | 2 +-
fs/autofs/root.c | 2 +-
fs/backing-file.c | 2 +-
fs/btrfs/inode.c | 2 +-
fs/ceph/dir.c | 3 +-
fs/coda/dir.c | 7 +-
fs/dcache.c | 23 ++-
fs/erofs/zdata.c | 4 +-
fs/eventpoll.c | 6 +-
fs/ext2/namei.c | 2 +-
fs/ext4/namei.c | 2 +-
fs/f2fs/namei.c | 2 +-
fs/filesystems.c | 18 +-
fs/fuse/dir.c | 8 +
fs/gfs2/glock.c | 6 +-
fs/gfs2/inode.c | 2 +-
fs/gfs2/lock_dlm.c | 6 +-
fs/gfs2/quota.c | 4 +-
fs/hfs/dir.c | 2 +-
fs/hfs/super.c | 2 +-
fs/hfsplus/dir.c | 2 +-
fs/hfsplus/super.c | 2 +-
fs/hpfs/namei.c | 4 +-
fs/hugetlbfs/inode.c | 2 +-
fs/inode.c | 42 ++---
fs/iomap/buffered-io.c | 4 +-
fs/jffs2/dir.c | 2 -
fs/jffs2/wbuf.c | 2 +-
fs/jfs/namei.c | 2 +-
fs/minix/namei.c | 2 +-
fs/namei.c | 7 +-
fs/namespace.c | 2 +-
fs/nfs/dir.c | 2 +-
fs/nilfs2/namei.c | 2 +-
fs/ntfs/namei.c | 2 +-
fs/ntfs3/namei.c | 2 +-
fs/nullfs.c | 2 +
fs/ocfs2/dlmfs/dlmfs.c | 2 +-
fs/ocfs2/namei.c | 2 +-
fs/omfs/dir.c | 2 +-
fs/orangefs/namei.c | 2 +-
fs/pidfs.c | 43 +++--
fs/pipe.c | 191 ++++++++++-----------
fs/posix_acl.c | 2 -
fs/ramfs/inode.c | 2 +-
fs/romfs/super.c | 8 +
fs/seq_file.c | 11 +-
fs/smb/client/inode.c | 7 +
fs/stat.c | 2 +-
fs/super.c | 19 +-
fs/ubifs/dir.c | 2 +-
fs/udf/namei.c | 2 +-
fs/ufs/namei.c | 2 +-
fs/ufs/super.c | 2 +-
fs/xfs/xfs_buf.c | 4 +-
fs/xfs/xfs_iops.c | 2 +-
fs/xfs/xfs_qm.c | 4 +-
include/linux/fs.h | 20 +--
include/linux/lockref.h | 12 +-
include/linux/pipe_fs_i.h | 26 ++-
include/linux/seq_file.h | 2 +-
include/linux/stat.h | 4 +-
include/uapi/linux/nsfs.h | 7 +-
init/initramfs.c | 2 +-
lib/lockref.c | 2 +-
lib/seq_buf.c | 2 +-
tools/testing/selftests/Makefile | 1 +
.../filesystems/epoll/epoll_wakeup_test.c | 23 +++
.../selftests/filesystems/mntns_cleanup/.gitignore | 2 +
.../selftests/filesystems/mntns_cleanup/Makefile | 6 +
.../filesystems/mntns_cleanup/mntns_cleanup_test.c | 58 +++++++
.../filesystems/statmount/statmount_test.c | 5 +-
tools/testing/selftests/namespaces/nsid_test.c | 4 -
tools/testing/selftests/proc/proc-pidns.c | 1 +
79 files changed, 419 insertions(+), 266 deletions(-)
create mode 100644 tools/testing/selftests/filesystems/mntns_cleanup/.gitignore
create mode 100644 tools/testing/selftests/filesystems/mntns_cleanup/Makefile
create mode 100644 tools/testing/selftests/filesystems/mntns_cleanup/mntns_cleanup_test.c