Pull vfs fixes from Christian Brauner:

 - libfs: Make readdir on tmpfs walk the offset tree in offset order
   instead of d_children to avoid skipping entries or relisting the
   whole directory

   It's faster too. Listing a million entries takes 114ms instead of
   146ms, and 113ms instead of 470ms with four processes listing in
   parallel

 - iomap: Finish the ->iomap_next() conversion that started in v7.3

   The nilfs2 and fuse ext_map iomap code added this merge window is
   converted so now we can remove the ->iomap_begin()/->iomap_end()
   fallback. We waited until the new iomap users from other trees were
   in mainline otherwise this would have been very messy

 - errseq: Retry with the current value when the cmpxchg() in
   errseq_check_and_advance() fails to avoid an old value coming back
   later hiding the errors

 - aio: Hold an extra count for exit_aio() itself so it can't return
   before the last free_ioctx_reqs() callback has called complete()

 - pidfd: Fail the namespace ioctls with EREMOTE unless the target is
   visible in the caller's pid namespace like PIDFD_GET_INFO does

 - eventpoll: Wake the next waiter when a woken waiter returns early
   because of a fatal signal to avoid sleeping forever

 - backing-file: Pass RWF_NOAPPEND on to synchronous writes to the
   backing file

 - initrd: Flush the deferred fput() of the ramdisk file before mounting
   root

 - iov_iter: Take an unsigned long segment count in import_iovec()

   The upper 32 bits of the count passed to readv(), writev() and
   friends were dropped before the UIO_MAXIOV check

 - splice: Advance the pipe tail before checking for a full bvec array
   in splice_to_socket(). The last buffer was counted again, so MSG_MORE
   was set although the pipe was empty and small TCP transfers waited
   for the cork timeout

 - vfs:

     - Reject negative offsets for SEEK_DATA and SEEK_HOLE in
       default_llseek() and use must_set_pos() for its whence handling

     - Only clear tv_nsec in timestamp_truncate() when clamping changed
       the seconds. Timestamps whose seconds were exactly at a
       filesystem time limit lost their subsecond part

     - Don't leak the kernel-internal STATX_ATTR_CHANGE_MONOTONIC in
       stx_attributes_mask

     - Clamp the FIONREAD result to the int range so a file with 4 GiB
       left isn't reported as empty

     - Fix the SEEK_CUR f_lock check

 - selftests: Fix the statmount and mount_setattr tests on 32-bit and
   s390, build the fchmodat2 and openat2 tests without sanitizers when
   the toolchain lacks the runtimes and fix a clang warning in the
   mount-notify test

 - docs: Fix a docutils warning in porting.rst

* tag 'vfs-7.4-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits)
  fs: fix the SEEK_CUR f_lock condition
  splice, net: avoid MSG_MORE when the bvec array fills
  aio: don't let exit_aio() return before complete() is done
  fs: porting.rst: use literal string to avoid warning
  selftests/fs/mount-notify: fix the indentation in the fsmount test
  selftests: probe for sanitizer support in fchmodat2 and openat2
  selftests/mount_setattr: build with a 64-bit off_t
  selftests/statmount: fix format warnings on 32-bit and s390
  fs: use must_set_pos() in default_llseek()
  fs: reject negative offsets for SEEK_DATA and SEEK_HOLE in default_llseek()
  pidfd: restrict task access ioctls to the caller's pid namespace
  fs: clamp FIONREAD result to int range
  eventpoll: wake the next waiter when a woken waiter is killed
  statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask
  vfs: preserve subsecond timestamps at filesystem time limits
  iov_iter: take an unsigned long segment count in import_iovec()
  lib/tests: errseq: add a concurrent check_and_advance test
  errseq: don't let errseq_check_and_advance() hide later errors
  backing-file: pass RWF_NOAPPEND to synchronous writes
  initrd: flush deferred fput() before mounting root
  ...

Pull key fixes from Jarkko Sakkinen:

 - Expand key->datalen and key->quotalen in order to avoid integer
   truncation and the leak of quota.

 - Enforce KEY_MAX_DESC_SIZE limits across in-kernel and
   payload-generated paths.

 - Verify the key identity in __key_unlink_begin() as type and
   description could also refer to a more recently linked key with
   matching properties as the one being unlinked.

 - Fix key update race with key GC

* tag 'keys-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  KEYS: Protect the update method check against type removal
  KEYS: Verify the key identity in __key_unlink_begin
  KEYS: Reject descriptions larger than KEY_MAX_DESC_SIZE
  KEYS: Expand key->{datalen,quotalen} to unsigned int

Commit da06e3c51794 ("fs: don't needlessly acquire f_lock") wanted to
skip f_lock for SEEK_CUR on files that already serialize f_pos through
f_pos_lock, i.e. FMODE_ATOMIC_POS files and directories, and keep it
for everything else. The condition it added does the opposite:
file_seek_cur_needs_f_lock() returns false exactly for the files that
never take f_pos_lock and true for the ones that do.

So since v6.15 a SEEK_CUR on a shared block device or on a character
device that uses fixed_size_llseek() updates f_pos without any lock and
two concurrent calls can lose an update, while regular files and
directories pay for a spinlock they don't need.

Invert the condition.

Fixes: da06e3c51794 ("fs: don't needlessly acquire f_lock")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261106-work-file-seek_f_lock-v1-1-5b9a6c2928d4@kernel.org
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Pull devm_kmalloc_obj conversion from Kees Cook:

 - treewide refresh of kmalloc_obj() conversions

 - devm_kmalloc_obj conversion rules added to Coccinelle scripting

 - treewide conversion of devm_kmalloc() family to devm_kmalloc_obj()

* tag 'devm_kmalloc_obj-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family
  coccinelle: kmalloc_obj: Include devm_kmalloc_obj conversion rules
  treewide: refresh kmalloc_obj() conversions

Pull driver core fixes from Danilo Krummrich:

 - Fix an unused-function warning in the Rust I/O code that breaks
   builds with CONFIG_PCI disabled and CONFIG_WERROR enabled

 - Fix kernfs sparse warnings on SMP Alpha when inheriting a parent
   node's group ID

 - Add Johan Hovold as an auxiliary bus maintainer

* tag 'driver-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
  MAINTAINERS: update auxiliary bus entry
  kernfs: avoid READ_ONCE() on a kgid_t in kernfs_new_node()
  rust: io: fix unused Flags::from_raw warning without CONFIG_PCI

Pull btrfs fixes from David Sterba:
 "A btrfs fixes. The ones that could have some user noticeable impact
  are enumerated, the rest is one-liners.

   - fix chattr failing on files with nodatasum and compress flags

   - fix inode defrag status with concurrent truncation so it's not
     skipped in defrag in the future

   - fix merging compressed extent in fiemap output

   - fix deleting wrong subvolume by id if it gets renamed during the
     ioctl

   - error handling fixes: sysfs, quotas, fs-verity, scrub, zoned mode"

* tag 'for-7.4-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: zoned: fix double free of bitmaps on clone failure
  btrfs: prevent deleting the wrong subvolume by ID
  btrfs: scrub: fix race between scrub and scrub progress ioctl
  btrfs: scrub: fix race leading to use-after-free in the scrub progress ioctl
  btrfs: scrub: fix lost wakeup and hang when cancelling a scrub that is finishing
  btrfs: scrub: fix lost error return value when scrubbing raid56 parity stripe
  btrfs: fix fiemap merging compressed extents
  btrfs: fix the fsverity callback where unexpected range is verified
  btrfs: verity: propagate orphan insertion errors when enabling verity
  btrfs: sysfs: restore NOFS context on early return in btrfs_sysfs_add_block_group_type()
  btrfs: defrag: prevent inode truncated to zero from not being defragged again
  btrfs: cleanup dirty_cowonly_roots during btrfs_free_fs_roots()
  btrfs: cleanup qgroup swapped blocks at root release
  btrfs: always remove quota_root from dirty_cowonly_roots
  btrfs: unwind device add when sysfs registration fails
  btrfs: fix chattr failing on nodatasum files that have the compress flag

Pull smb server updates from Namjae Jeon:

 - Validate EA-name NUL termination to prevent out-of-bounds reads in
   debug logging. Return STATUS_EA_LIST_INCONSISTENT for malformed EA
   names in CREATE and SET_INFO requests.

 - Grant the owner's implicit READ_CONTROL and WRITE_DAC rights when no
   ACE names it, including MAXIMUM_ALLOWED handling, while respecting
   applicable OWNER RIGHTS ACEs.

 - Check group membership before granting permissions from a POSIX ACL
   group entry, preventing unintended access when a caller's UID matches
   the group's numeric GID.

 - Avoid reading past the DACL when logging an access denial by printing
   the requested and allowed access masks instead.

 - Handle unauthenticated sessions in procfs reporting without
   dereferencing a NULL session->user.

 - Fix credential cleanup on attribute lookup failures during durable
   handle reconnect or request replay, preventing subsequent requests
   from running with another user's credentials.

 - Fix read-only share handling for named stream creation, including
   AFP_AfpInfo synthesis on Time Machine shares.

 - Validate DELETE access for FILE_DELETE_ON_CLOSE opens, including
   MAXIMUM_ALLOWED handling, to prevent unauthorized deletion or
   delete-pending states.

* tag 'ksmbd-for-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb:
  ksmbd: require NUL-terminated EA names
  ksmbd: let the owner read and change the DACL when no ACE names it
  ksmbd: grant a POSIX ACL group entry only to the group's members
  ksmbd: do not read past the DACL in the access denied debug message
  ksmbd: fix NULL pointer dereference in session_user_name() and session_account_type()
  ksmbd: revert fsids on durable reconnect and replay failure
  ksmbd: enforce the read-only share flag when creating a stream
  ksmbd: require DELETE access for delete-on-close opens

Pull ntfs fixes from Namjae Jeon:

 - Don't allow compression to be enabled through system.ntfs_attrib on
   volumes with clusters larger than 4 KiB, preventing out-of-bounds
   accesses in the compressed read path.

 - Don't allow resident attribute values to overlap the attribute
   header, preventing malformed records from causing writes outside the
   MFT record buffer.

 - Fix recursive acquisition of the mapping invalidate lock when writing
   to non-resident named streams through NTFS_IOC_STREAM_WRITE.

 - Keep the file size unchanged when extending the initialized size
   fails, avoiding unintended truncation and page-cache removal.

 - Avoid integer overflow when limiting attribute reads to the attribute
   size.

 - Initialize the promoted index entry's child VCN before inserting it
   into the parent during an index split.

 - Validate index entry VCNs and return an error for negative attribute
   read positions before they reach pointer arithmetic.

 - Fix cleanup after ACL initialization fails in __ntfs_create(),
   avoiding an erroneous free of $MFT, unmapping an unmapped record, and
   unlocking mutexes that were never held.

* tag 'ntfs-for-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:
  ntfs: don't allow compression on volumes with clusters larger than 4K
  ntfs: don't allow resident values to overlap the attribute header
  ntfs: fix a self-deadlock on writes to non-resident named streams
  ntfs: keep the file size on a failed initialized-size extension
  ntfs: avoid overflow when limiting attribute read length
  ntfs: initialize VCN when inserting index entries
  ntfs: reject negative attribute read positions
  ntfs: Fix error handling in __ntfs_create()

Pull udf, ext2, isofs and quota fixes from Jan Kara:
 - Some disk format validation improvements for udf
 - Fix isofs handling of dates before 1900
 - Fix ext2 inadvertedly syncing buffer on every directory modification
 - Fix ext2 O_DSYNC handling for direct IO
 - A couple of smaller ext2 fixes
 - Fix tmpfs quotas for root filesystem
 - Unify my email addresses in MAINTAINERS file

* tag 'fs_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  udf: Fix incorrect error code in udf_current_aext()
  udf: Simplify udf_table_prealloc_blocks()
  udf: don't use eloc after the end of the unallocated space table
  udf: fix preallocation discarding before an empty allocation extent
  udf: check the unallocated space table when it is loaded
  udf: don't let the extent type hide an exhausted free-space table extent
  ext2: preserve IOMAP_F_DIRTY for extending direct writes
  udf, ext2, quota, jbd2: Unify email addresses in MAINTAINERS
  isofs: handle Rock Ridge long-form dates before 1900
  ext2: only flush DIRSYNC directories on every change
  ext2: preserve completed DIO bytes when buffered fallback fails
  ext2: take invalidate_lock in ext2_write_failed()
  ext2: Make sbi an proper alias for EXT2_SB(sb) in ext2_fill_super()
  udf: Validate extended attribute space is large enough
  quota: initialize dquot cache before mounting rootfs
  udf: validate vat20->lengthHeader and VAT inode size in udf_load_vat()

Pull fsnotify fixes from Jan Kara:
 "Two small fixes for fsnotify"

* tag 'fsnotify_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  inotify: do not coalesce rename events
  fsnotify: preserve 64-bit pre-content ranges