linux-toradex.git/fs/ufs, branch master Linux kernel for Apalis and Colibri modules Merge tag 'vfs-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs 2026-10-20T05:30:45+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-10-20T05:30:45+00:00 7ed37e9d5c05bf3dc74146572d89e7391091e1a4 Pull misc vfs updates from Christian Brauner: "Fixes: - aio: a keyed poll completion on an epoll instance could recurse into the same epoll waitqueue lock when the result eventfd is watched by that very instance. An unprivileged process could make a CPU spin on the recursive lock. eventfd-backed poll completions are always deferred now. - fsnotify_inoderemove() is only called once the inode is really dead, no nlink and no aliases, and open_by_handle_at() can't add an alias to a dead inode anymore. The race could crash fsnotify or lose inode mark notifications. - devtmpfs: the conversion of the public instance to ->get_tree() broke reconfiguring the shared superblock's options on later mounts which made the boot time defaults permanent. A reconfigure context is kept in fc->fs_private so the parse ops can forward options to the underlying filesystem. - ufs truncated the 64-bit directory size to an unsigned int in ufs_last_byte(). A crafted image with a 4 GiB directory produced an out-of-folio read in ufs_find_entry() and, with CONFIG_UFS_FS_WRITE, a write into an adjacent page. - devpts rejects max=0 instead of silently lifting the per-instance pty limit. The value wrapped into ida_alloc_max() and became unlimited. - fs_pin publishes pins with the rcu list helpers so the kill paths reading the lists under rcu see the initialization. - dentry_kill() reports a Tasks-RCU quiescent state. Its cond_resched() is the only reschedule point on the dentry teardown path and cond_resched() isn't a quiescent state for Tasks-RCU, so Meta kept seeing rcu_tasks stalls in btrfs subvolume deletion. - writeback sizes foreign flushes by the target wb's dirty pages instead of the memcg-wide count which over or undersized a single bdi flush. - nfsd READ emitted two fsnotify access events on the iterator path since vfs_iocb_iter_read() already sends one. A READ on a krb5i or krb5p mount showed up twice in inotify. - pipe and splice pass a poll key when waking readers and writers so epoll, poll() and select() waiters only wake for the event they asked for. - the iso8859-14 Unicode to charset tables had page01 duplicated as page1e so 29 code points mapped to the wrong bytes and 22 that aren't in the charset were accepted. - orangefs doesn't wait for an unmount service operation that never returns on system shutdown and uses ssize_t for strscpy() errors. - __register_chrdev() checks the kobject_set_name() return value. - selftest fixes: the openat2 tests hardcoded O_LARGEFILE to 0x8000 which is O_NOFOLLOW on powerpc, resolve_test makes /tmp a mountpoint so RESOLVE_NO_XDEV has a boundary to trip over, file_stressor moves into its own directory with a 30 minute timeout, the kernfs listxattr test skips when SELinux exposes security.selinux, the namespaces active reference tests wait for the thread via a PIDFD_THREAD pidfd since pthread_join() returns before exit_nsproxy_namespaces(), the idmapped_tmpfile test chowns its directory into the mapped range, the clone3 CLONE_CLEAR_SIGHAND test adds CLONE_VM so it fails for the intended reason, the pidfd PPID error message prints the values it compares and fscontext_ns gets a .gitignore. Cleanups: - vmcore prints the release of the crashed kernel from the VMCOREINFO note so a kdump that dies before the dump lands still says which kernel it was for. - initramfs allocates hardlink hash entries with the validated cpio name length instead of PATH_MAX, which put every entry in kmalloc-8k. - the unused dax_layout_busy_page() is removed, dax_layout_busy_page_range() becomes static and dax_folio_init() drops a redundant list initialization. - vfs_empty_path() is removed, it has had no callers since getname_maybe_null(). - comment and documentation fixes in aio, bpf_fs_kfuncs, fs-writeback, inode, read_write, squashfs and the vfs.rst copy of struct file_system_type" * tag 'vfs-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (38 commits) selftests/filesystems: Fix idmapped_tmpfile layer dir ownership selftests/namespaces: Wait for thread exit via pidfd in active-ref tests writeback: size foreign flushes by target wb dirty pages initramfs: Reduce hardlink hash allocation sizes fs: remove unused vfs_empty_path() dcache: report a Tasks-RCU quiescent state in dentry_kill() vmcore: report the release of the crashed kernel splice: pass a poll key when waking pipe readers and writers pipe: pass a poll key when waking writers after a resize orangefs: use ssize_t instead of size_t for error codes... orangefs_super: don't wait on service operation on system shutdown. docs/vfs: Fix the struct file_system_type copy nls: fix the Unicode to charset tables of iso8859-14 selftests/filesystems/openat2: make /tmp a mountpoint inside private namespace selftests/filesystems/openat2: fix O_LARGEFILE definitions for non-arm64 architectures fs: fix misleading comments in read_write.c squashfs: fix inode number description in documentation fs: fix typos in comments fs/dax: Make dax_layout_busy_page_range() static fs/dax: Remove unused dax_layout_busy_page() ... 
Pull misc vfs updates from Christian Brauner:
 "Fixes:

   - aio: a keyed poll completion on an epoll instance could recurse
     into the same epoll waitqueue lock when the result eventfd is
     watched by that very instance. An unprivileged process could make a
     CPU spin on the recursive lock. eventfd-backed poll completions are
     always deferred now.

   - fsnotify_inoderemove() is only called once the inode is really
     dead, no nlink and no aliases, and open_by_handle_at() can't add an
     alias to a dead inode anymore. The race could crash fsnotify or
     lose inode mark notifications.

   - devtmpfs: the conversion of the public instance to ->get_tree()
     broke reconfiguring the shared superblock's options on later mounts
     which made the boot time defaults permanent. A reconfigure context
     is kept in fc->fs_private so the parse ops can forward options to
     the underlying filesystem.

   - ufs truncated the 64-bit directory size to an unsigned int in
     ufs_last_byte(). A crafted image with a 4 GiB directory produced an
     out-of-folio read in ufs_find_entry() and, with
     CONFIG_UFS_FS_WRITE, a write into an adjacent page.

   - devpts rejects max=0 instead of silently lifting the per-instance
     pty limit. The value wrapped into ida_alloc_max() and became
     unlimited.

   - fs_pin publishes pins with the rcu list helpers so the kill paths
     reading the lists under rcu see the initialization.

   - dentry_kill() reports a Tasks-RCU quiescent state. Its
     cond_resched() is the only reschedule point on the dentry teardown
     path and cond_resched() isn't a quiescent state for Tasks-RCU, so
     Meta kept seeing rcu_tasks stalls in btrfs subvolume deletion.

   - writeback sizes foreign flushes by the target wb's dirty pages
     instead of the memcg-wide count which over or undersized a single
     bdi flush.

   - nfsd READ emitted two fsnotify access events on the iterator path
     since vfs_iocb_iter_read() already sends one. A READ on a krb5i or
     krb5p mount showed up twice in inotify.

   - pipe and splice pass a poll key when waking readers and writers so
     epoll, poll() and select() waiters only wake for the event they
     asked for.

   - the iso8859-14 Unicode to charset tables had page01 duplicated as
     page1e so 29 code points mapped to the wrong bytes and 22 that
     aren't in the charset were accepted.

   - orangefs doesn't wait for an unmount service operation that never
     returns on system shutdown and uses ssize_t for strscpy() errors.

   - __register_chrdev() checks the kobject_set_name() return value.

   - selftest fixes: the openat2 tests hardcoded O_LARGEFILE to 0x8000
     which is O_NOFOLLOW on powerpc, resolve_test makes /tmp a
     mountpoint so RESOLVE_NO_XDEV has a boundary to trip over,
     file_stressor moves into its own directory with a 30 minute
     timeout, the kernfs listxattr test skips when SELinux exposes
     security.selinux, the namespaces active reference tests wait for
     the thread via a PIDFD_THREAD pidfd since pthread_join() returns
     before exit_nsproxy_namespaces(), the idmapped_tmpfile test chowns
     its directory into the mapped range, the clone3 CLONE_CLEAR_SIGHAND
     test adds CLONE_VM so it fails for the intended reason, the pidfd
     PPID error message prints the values it compares and fscontext_ns
     gets a .gitignore.

  Cleanups:

   - vmcore prints the release of the crashed kernel from the VMCOREINFO
     note so a kdump that dies before the dump lands still says which
     kernel it was for.

   - initramfs allocates hardlink hash entries with the validated cpio
     name length instead of PATH_MAX, which put every entry in
     kmalloc-8k.

   - the unused dax_layout_busy_page() is removed,
     dax_layout_busy_page_range() becomes static and dax_folio_init()
     drops a redundant list initialization.

   - vfs_empty_path() is removed, it has had no callers since
     getname_maybe_null().

   - comment and documentation fixes in aio, bpf_fs_kfuncs,
     fs-writeback, inode, read_write, squashfs and the vfs.rst copy of
     struct file_system_type"

* tag 'vfs-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (38 commits)
  selftests/filesystems: Fix idmapped_tmpfile layer dir ownership
  selftests/namespaces: Wait for thread exit via pidfd in active-ref tests
  writeback: size foreign flushes by target wb dirty pages
  initramfs: Reduce hardlink hash allocation sizes
  fs: remove unused vfs_empty_path()
  dcache: report a Tasks-RCU quiescent state in dentry_kill()
  vmcore: report the release of the crashed kernel
  splice: pass a poll key when waking pipe readers and writers
  pipe: pass a poll key when waking writers after a resize
  orangefs: use ssize_t instead of size_t for error codes...
  orangefs_super: don't wait on service operation on system shutdown.
  docs/vfs: Fix the struct file_system_type copy
  nls: fix the Unicode to charset tables of iso8859-14
  selftests/filesystems/openat2: make /tmp a mountpoint inside private namespace
  selftests/filesystems/openat2: fix O_LARGEFILE definitions for non-arm64 architectures
  fs: fix misleading comments in read_write.c
  squashfs: fix inode number description in documentation
  fs: fix typos in comments
  fs/dax: Make dax_layout_busy_page_range() static
  fs/dax: Remove unused dax_layout_busy_page()
  ...
Merge tag 'vfs-7.4-rc1.idmap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs 2026-10-20T03:57:49+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-10-20T03:57:49+00:00 00b04f4495c354cad82f96d41947aa70f71e2cc4 Pull vfs idmap constification from Christian Brauner: "This makes struct mnt_idmap const throughout the tree. A mount's idmapping is immutable. The only thing modified after alloc_mnt_idmap() is the reference count and that is hidden behind mnt_idmap_get() and mnt_idmap_put(). Everything else only reads from it. That is the same model struct cred uses and the idmapping is sensitive enough to deserve it. The conversion goes bottom up through the vfs{g,u}id and fs{g,u}id helpers, the privilege checks, acl, xattr and quota and then every inode operation that takes an idmap, so ->permission(), ->getattr(), ->setattr(), ->create(), ->mkdir(), ->mknod(), ->symlink(), ->rename(), ->tmpfile(), ->get_acl(), ->set_acl() and ->fileattr_set() with their implementations in every filesystem, plus the LSM hooks. struct vfsmount, struct mount_kattr and struct kstatmount store a const pointer and nop_mnt_idmap and invalid_mnt_idmap live in rodata, so anything that tries to modify them faults instead of silently corrupting the initial idmapping" * tag 'vfs-7.4-rc1.idmap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (27 commits) fs: make nop_mnt_idmap and invalid_mnt_idmap const fs: port mnt_idmap() and file_mnt_idmap() to const mnt_idmap fs: port vfs_*() helpers to const mnt_idmap fs: port ->setattr() to pass const mnt_idmap fs: port ->getattr() to pass const mnt_idmap fs: port ->create() to pass const mnt_idmap fs: port ->symlink() to pass const mnt_idmap fs: port ->mkdir() to pass const mnt_idmap fs: port ->rename() to pass const mnt_idmap fs: port ->mknod() to pass const mnt_idmap fs: port ->tmpfile() to pass const mnt_idmap fs: port ->get_acl() to pass const mnt_idmap fs: port ->set_acl() to pass const mnt_idmap fs: port ->fileattr_set() to pass const mnt_idmap fs: port xattr to const mnt_idmap fs: port ->permission() to pass const mnt_idmap fs: port acl to const mnt_idmap fs: port inode_init_owner() to const mnt_idmap fs: port inode_owner_or_capable() to const mnt_idmap fs: port privilege checking helpers to const mnt_idmap ... 
Pull vfs idmap constification from Christian Brauner:
 "This makes struct mnt_idmap const throughout the tree.

  A mount's idmapping is immutable. The only thing modified after
  alloc_mnt_idmap() is the reference count and that is hidden behind
  mnt_idmap_get() and mnt_idmap_put(). Everything else only reads from
  it. That is the same model struct cred uses and the idmapping is
  sensitive enough to deserve it.

  The conversion goes bottom up through the vfs{g,u}id and fs{g,u}id
  helpers, the privilege checks, acl, xattr and quota and then every
  inode operation that takes an idmap, so ->permission(), ->getattr(),
  ->setattr(), ->create(), ->mkdir(), ->mknod(), ->symlink(),
  ->rename(), ->tmpfile(), ->get_acl(), ->set_acl() and ->fileattr_set()
  with their implementations in every filesystem, plus the LSM hooks.

  struct vfsmount, struct mount_kattr and struct kstatmount store a
  const pointer and nop_mnt_idmap and invalid_mnt_idmap live in rodata,
  so anything that tries to modify them faults instead of silently
  corrupting the initial idmapping"

* tag 'vfs-7.4-rc1.idmap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (27 commits)
  fs: make nop_mnt_idmap and invalid_mnt_idmap const
  fs: port mnt_idmap() and file_mnt_idmap() to const mnt_idmap
  fs: port vfs_*() helpers to const mnt_idmap
  fs: port ->setattr() to pass const mnt_idmap
  fs: port ->getattr() to pass const mnt_idmap
  fs: port ->create() to pass const mnt_idmap
  fs: port ->symlink() to pass const mnt_idmap
  fs: port ->mkdir() to pass const mnt_idmap
  fs: port ->rename() to pass const mnt_idmap
  fs: port ->mknod() to pass const mnt_idmap
  fs: port ->tmpfile() to pass const mnt_idmap
  fs: port ->get_acl() to pass const mnt_idmap
  fs: port ->set_acl() to pass const mnt_idmap
  fs: port ->fileattr_set() to pass const mnt_idmap
  fs: port xattr to const mnt_idmap
  fs: port ->permission() to pass const mnt_idmap
  fs: port acl to const mnt_idmap
  fs: port inode_init_owner() to const mnt_idmap
  fs: port inode_owner_or_capable() to const mnt_idmap
  fs: port privilege checking helpers to const mnt_idmap
  ...
fs: port ->setattr() to pass const mnt_idmap 2026-09-23T07:19:51+00:00 Christian Brauner brauner@kernel.org 2026-09-01T12:14:49+00:00 e2f0d6d4569d14609644c45b029e23428069175b Convert to const struct mnt_idmap. A mount's idmapping is immutable. The only thing that is allowed to be modified afterwards is the reference count and that is hidden behind mnt_idmap_get() and mnt_idmap_put(). Everything else only ever reads from the idmapping. This is the same model that struct cred uses and the idmapping is also rather sensitive. So make the idmap argument const wherever we can. The conversion is done from the bottom up so callers can continue to pass a non-const pointer to a const parameter until the conversion is finished. No functional changes. Link: https://patch.msgid.link/20260901-work-idmap-const-v1-24-54ccd48e100b@kernel.org Acked-by: Paul Moore <paul@paul-moore.com> Reviewed-by: Jan Kara <jack@suse.cz> Reviewed-by: Seth Forshee <sforshee@kernel.org> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> 
Convert to const struct mnt_idmap.

A mount's idmapping is immutable. The only thing that is allowed to be
modified afterwards is the reference count and that is hidden behind
mnt_idmap_get() and mnt_idmap_put(). Everything else only ever reads
from the idmapping. This is the same model that struct cred uses and the
idmapping is also rather sensitive.

So make the idmap argument const wherever we can. The conversion is done
from the bottom up so callers can continue to pass a non-const pointer
to a const parameter until the conversion is finished.

No functional changes.

Link: https://patch.msgid.link/20260901-work-idmap-const-v1-24-54ccd48e100b@kernel.org
Acked-by: Paul Moore <paul@paul-moore.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Seth Forshee <sforshee@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
fs: port ->create() to pass const mnt_idmap 2026-09-23T07:19:51+00:00 Christian Brauner brauner@kernel.org 2026-09-01T12:14:47+00:00 eb50cbe14ff97ea533708bfc40a74df7af380e5f Convert to const struct mnt_idmap. A mount's idmapping is immutable. The only thing that is allowed to be modified afterwards is the reference count and that is hidden behind mnt_idmap_get() and mnt_idmap_put(). Everything else only ever reads from the idmapping. This is the same model that struct cred uses and the idmapping is also rather sensitive. So make the idmap argument const wherever we can. The conversion is done from the bottom up so callers can continue to pass a non-const pointer to a const parameter until the conversion is finished. No functional changes. Link: https://patch.msgid.link/20260901-work-idmap-const-v1-22-54ccd48e100b@kernel.org Reviewed-by: Jan Kara <jack@suse.cz> Reviewed-by: Seth Forshee <sforshee@kernel.org> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> 
Convert to const struct mnt_idmap.

A mount's idmapping is immutable. The only thing that is allowed to be
modified afterwards is the reference count and that is hidden behind
mnt_idmap_get() and mnt_idmap_put(). Everything else only ever reads
from the idmapping. This is the same model that struct cred uses and the
idmapping is also rather sensitive.

So make the idmap argument const wherever we can. The conversion is done
from the bottom up so callers can continue to pass a non-const pointer
to a const parameter until the conversion is finished.

No functional changes.

Link: https://patch.msgid.link/20260901-work-idmap-const-v1-22-54ccd48e100b@kernel.org
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Seth Forshee <sforshee@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
fs: port ->symlink() to pass const mnt_idmap 2026-09-23T07:19:50+00:00 Christian Brauner brauner@kernel.org 2026-09-01T12:14:46+00:00 6bd532e338759278b5cc1e912cf9b67a997e658c Convert to const struct mnt_idmap. A mount's idmapping is immutable. The only thing that is allowed to be modified afterwards is the reference count and that is hidden behind mnt_idmap_get() and mnt_idmap_put(). Everything else only ever reads from the idmapping. This is the same model that struct cred uses and the idmapping is also rather sensitive. So make the idmap argument const wherever we can. The conversion is done from the bottom up so callers can continue to pass a non-const pointer to a const parameter until the conversion is finished. No functional changes. Link: https://patch.msgid.link/20260901-work-idmap-const-v1-21-54ccd48e100b@kernel.org Reviewed-by: Jan Kara <jack@suse.cz> Reviewed-by: Seth Forshee <sforshee@kernel.org> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> 
Convert to const struct mnt_idmap.

A mount's idmapping is immutable. The only thing that is allowed to be
modified afterwards is the reference count and that is hidden behind
mnt_idmap_get() and mnt_idmap_put(). Everything else only ever reads
from the idmapping. This is the same model that struct cred uses and the
idmapping is also rather sensitive.

So make the idmap argument const wherever we can. The conversion is done
from the bottom up so callers can continue to pass a non-const pointer
to a const parameter until the conversion is finished.

No functional changes.

Link: https://patch.msgid.link/20260901-work-idmap-const-v1-21-54ccd48e100b@kernel.org
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Seth Forshee <sforshee@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
fs: port ->mkdir() to pass const mnt_idmap 2026-09-23T07:19:50+00:00 Christian Brauner brauner@kernel.org 2026-09-01T12:14:45+00:00 566707035a6e0c859632523f679d9454ebbbe184 Convert to const struct mnt_idmap. A mount's idmapping is immutable. The only thing that is allowed to be modified afterwards is the reference count and that is hidden behind mnt_idmap_get() and mnt_idmap_put(). Everything else only ever reads from the idmapping. This is the same model that struct cred uses and the idmapping is also rather sensitive. So make the idmap argument const wherever we can. The conversion is done from the bottom up so callers can continue to pass a non-const pointer to a const parameter until the conversion is finished. No functional changes. Link: https://patch.msgid.link/20260901-work-idmap-const-v1-20-54ccd48e100b@kernel.org Reviewed-by: Jan Kara <jack@suse.cz> Reviewed-by: Seth Forshee <sforshee@kernel.org> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> 
Convert to const struct mnt_idmap.

A mount's idmapping is immutable. The only thing that is allowed to be
modified afterwards is the reference count and that is hidden behind
mnt_idmap_get() and mnt_idmap_put(). Everything else only ever reads
from the idmapping. This is the same model that struct cred uses and the
idmapping is also rather sensitive.

So make the idmap argument const wherever we can. The conversion is done
from the bottom up so callers can continue to pass a non-const pointer
to a const parameter until the conversion is finished.

No functional changes.

Link: https://patch.msgid.link/20260901-work-idmap-const-v1-20-54ccd48e100b@kernel.org
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Seth Forshee <sforshee@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
fs: port ->rename() to pass const mnt_idmap 2026-09-23T07:19:50+00:00 Christian Brauner brauner@kernel.org 2026-09-01T12:14:44+00:00 8ee61322bb530771f78309a5b25eb5485ff0ff90 Convert to const struct mnt_idmap. A mount's idmapping is immutable. The only thing that is allowed to be modified afterwards is the reference count and that is hidden behind mnt_idmap_get() and mnt_idmap_put(). Everything else only ever reads from the idmapping. This is the same model that struct cred uses and the idmapping is also rather sensitive. So make the idmap argument const wherever we can. The conversion is done from the bottom up so callers can continue to pass a non-const pointer to a const parameter until the conversion is finished. No functional changes. Link: https://patch.msgid.link/20260901-work-idmap-const-v1-19-54ccd48e100b@kernel.org Reviewed-by: Jan Kara <jack@suse.cz> Reviewed-by: Seth Forshee <sforshee@kernel.org> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> 
Convert to const struct mnt_idmap.

A mount's idmapping is immutable. The only thing that is allowed to be
modified afterwards is the reference count and that is hidden behind
mnt_idmap_get() and mnt_idmap_put(). Everything else only ever reads
from the idmapping. This is the same model that struct cred uses and the
idmapping is also rather sensitive.

So make the idmap argument const wherever we can. The conversion is done
from the bottom up so callers can continue to pass a non-const pointer
to a const parameter until the conversion is finished.

No functional changes.

Link: https://patch.msgid.link/20260901-work-idmap-const-v1-19-54ccd48e100b@kernel.org
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Seth Forshee <sforshee@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
fs: port ->mknod() to pass const mnt_idmap 2026-09-23T07:19:50+00:00 Christian Brauner brauner@kernel.org 2026-09-01T12:14:43+00:00 7d0db72041b7415370ecd1e5260048ddd49e44d8 Convert to const struct mnt_idmap. A mount's idmapping is immutable. The only thing that is allowed to be modified afterwards is the reference count and that is hidden behind mnt_idmap_get() and mnt_idmap_put(). Everything else only ever reads from the idmapping. This is the same model that struct cred uses and the idmapping is also rather sensitive. So make the idmap argument const wherever we can. The conversion is done from the bottom up so callers can continue to pass a non-const pointer to a const parameter until the conversion is finished. No functional changes. Link: https://patch.msgid.link/20260901-work-idmap-const-v1-18-54ccd48e100b@kernel.org Acked-by: Paul Moore <paul@paul-moore.com> Reviewed-by: Jan Kara <jack@suse.cz> Reviewed-by: Seth Forshee <sforshee@kernel.org> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> 
Convert to const struct mnt_idmap.

A mount's idmapping is immutable. The only thing that is allowed to be
modified afterwards is the reference count and that is hidden behind
mnt_idmap_get() and mnt_idmap_put(). Everything else only ever reads
from the idmapping. This is the same model that struct cred uses and the
idmapping is also rather sensitive.

So make the idmap argument const wherever we can. The conversion is done
from the bottom up so callers can continue to pass a non-const pointer
to a const parameter until the conversion is finished.

No functional changes.

Link: https://patch.msgid.link/20260901-work-idmap-const-v1-18-54ccd48e100b@kernel.org
Acked-by: Paul Moore <paul@paul-moore.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Seth Forshee <sforshee@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
ufs: use u64 for directory size in ufs_last_byte 2026-09-04T11:03:10+00:00 YANXIN LI fadouse@pm.me 2026-07-18T19:03:07+00:00 1eff23433e73d7da4f9e3529d2701e34962b161f ufs1_read_inode() and ufs2_read_inode() copy the untrusted 64-bit on-disk size into inode->i_size. ufs_last_byte() then truncates that value to an unsigned int before calculating the valid extent of a directory folio. A directory size of exactly 4 GiB is truncated to zero. In ufs_find_entry(), subtracting the requested record length from that zero forms an endpoint almost 4 GiB beyond the mapped folio. A crafted UFS2 image produces: BUG: KASAN: use-after-free in ufs_find_entry+0x583/0x6e0 [ufs] Read of size 1 ... ufs_find_entry ufs_inode_by_name ufs_lookup __lookup_slow path_lookupat The KASAN classification reflects that the adjacent physical page was free; the source-level operation is an out-of-folio read. A controlled UFS1 test with CONFIG_UFS_FS_WRITE enabled also made ufs_find_entry() return a directory entry from an adjacent anonymous page. unlink() then passed that pointer to ufs_delete_entry(), which cleared the adjacent page's 3 2-bit d_ino. This write result reproduced three out of three times. UFS normally requires a privileged mount path. A relevant boundary is a privileged automounter or image-processing service handling an attacker-supplied filesystem. The write primitive additionally requires UFS1 to be mounted read-write with CONFIG_UFS_FS_WRITE enabled; the read is reachable with read-only UFS2. Keep the intermediate size arithmetic at 64 bits so non-final pages are bounded at PAGE_SIZE. With this change, the same controlled tests reach the real on-disk directory entry and produce no adjacent-page write or KASAN report. A reproducer and full validation logs are available on request. The vulnerable helper is present in v7.2-rc3, v7.1, v6.18.38, v6.12.95, v6.6.111, and upstream master at 1229e2e57a5c. Runtime reproduction and fix validation were performed in an x86-64 QEMU guest running v7.2-rc3 with generic KASAN. Fixes: b71034e5e67d ("[PATCH] ufs: directory and page cache: from blocks to pages") Cc: stable@vger.kernel.org Signed-off-by: YANXIN LI <fadouse@pm.me> Link: https://patch.msgid.link/20260718190300.867109-1-fadouse@pm.me Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> 
ufs1_read_inode() and ufs2_read_inode() copy the untrusted 64-bit
on-disk size into inode->i_size.  ufs_last_byte() then truncates that
value to an unsigned int before calculating the valid extent of a
directory folio.

A directory size of exactly 4 GiB is truncated to zero.  In
ufs_find_entry(), subtracting the requested record length from that zero
forms an endpoint almost 4 GiB beyond the mapped folio.  A crafted UFS2
image produces:

  BUG: KASAN: use-after-free in ufs_find_entry+0x583/0x6e0 [ufs]
  Read of size 1
  ...
  ufs_find_entry
  ufs_inode_by_name
  ufs_lookup
  __lookup_slow
  path_lookupat

The KASAN classification reflects that the adjacent physical page was
free; the source-level operation is an out-of-folio read.  A controlled
UFS1 test with CONFIG_UFS_FS_WRITE enabled also made ufs_find_entry()
return a directory entry from an adjacent anonymous page.  unlink() then
passed that pointer to ufs_delete_entry(), which cleared the adjacent
page's 3
2-bit d_ino.  This write result reproduced three out of three
times.

UFS normally requires a privileged mount path.  A relevant boundary is
a privileged automounter or image-processing service handling an
attacker-supplied filesystem.  The write primitive additionally requires
UFS1 to be mounted read-write with CONFIG_UFS_FS_WRITE enabled; the read
is reachable with read-only UFS2.

Keep the intermediate size arithmetic at 64 bits so non-final pages are
bounded at PAGE_SIZE.  With this change, the same controlled tests reach
the real on-disk directory entry and produce no adjacent-page write or
KASAN report.  A reproducer and full validation logs are available on
request.

The vulnerable helper is present in v7.2-rc3, v7.1, v6.18.38, v6.12.95,
v6.6.111, and upstream master at 1229e2e57a5c.  Runtime reproduction and
fix validation were performed in an x86-64 QEMU guest running v7.2-rc3
with generic KASAN.

Fixes: b71034e5e67d ("[PATCH] ufs: directory and page cache:  from blocks to pages")
Cc: stable@vger.kernel.org
Signed-off-by: YANXIN LI <fadouse@pm.me>
Link: https://patch.msgid.link/20260718190300.867109-1-fadouse@pm.me
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
ufs: do not treat unreadable directory blocks as empty 2026-08-25T12:44:18+00:00 Ali Ahmet Memis ali@iusegentoo.com 2026-08-01T01:39:32+00:00 08edfb34ee9ca54383970c65ed3a6013e84f5e16 ufs_empty_dir() scans every directory block to decide whether a directory is empty before rmdir() removes it. When ufs_get_folio() cannot read or validate a block it returns an error pointer, and the loop currently skips that block with continue and keeps scanning the remaining blocks. If none of the readable blocks hold an entry, the function returns 1 and the caller unlinks the directory. A directory whose contents live in a block that cannot be read, for example because of an I/O error or corrupted directory metadata, is therefore seen as empty and removed, losing the entries it still holds. Follow the ext2 behaviour and treat an unreadable block as a reason to consider the directory not empty, so rmdir() fails instead of discarding data that could not be verified. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com> Link: https://patch.msgid.link/20260801013942.279992-1-ali@iusegentoo.com Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> 
ufs_empty_dir() scans every directory block to decide whether a
directory is empty before rmdir() removes it. When ufs_get_folio()
cannot read or validate a block it returns an error pointer, and the
loop currently skips that block with continue and keeps scanning the
remaining blocks.

If none of the readable blocks hold an entry, the function returns 1
and the caller unlinks the directory. A directory whose contents live
in a block that cannot be read, for example because of an I/O error or
corrupted directory metadata, is therefore seen as empty and removed,
losing the entries it still holds.

Follow the ext2 behaviour and treat an unreadable block as a reason to
consider the directory not empty, so rmdir() fails instead of
discarding data that could not be verified.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Link: https://patch.msgid.link/20260801013942.279992-1-ali@iusegentoo.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>