Pull misc vfs updates from Christian Brauner:
 "Fixes:

   - aio: a keyed poll completion on an epoll instance could recurse
     into the same epoll waitqueue lock when the result eventfd is
     watched by that very instance. An unprivileged process could make a
     CPU spin on the recursive lock. eventfd-backed poll completions are
     always deferred now.

   - fsnotify_inoderemove() is only called once the inode is really
     dead, no nlink and no aliases, and open_by_handle_at() can't add an
     alias to a dead inode anymore. The race could crash fsnotify or
     lose inode mark notifications.

   - devtmpfs: the conversion of the public instance to ->get_tree()
     broke reconfiguring the shared superblock's options on later mounts
     which made the boot time defaults permanent. A reconfigure context
     is kept in fc->fs_private so the parse ops can forward options to
     the underlying filesystem.

   - ufs truncated the 64-bit directory size to an unsigned int in
     ufs_last_byte(). A crafted image with a 4 GiB directory produced an
     out-of-folio read in ufs_find_entry() and, with
     CONFIG_UFS_FS_WRITE, a write into an adjacent page.

   - devpts rejects max=0 instead of silently lifting the per-instance
     pty limit. The value wrapped into ida_alloc_max() and became
     unlimited.

   - fs_pin publishes pins with the rcu list helpers so the kill paths
     reading the lists under rcu see the initialization.

   - dentry_kill() reports a Tasks-RCU quiescent state. Its
     cond_resched() is the only reschedule point on the dentry teardown
     path and cond_resched() isn't a quiescent state for Tasks-RCU, so
     Meta kept seeing rcu_tasks stalls in btrfs subvolume deletion.

   - writeback sizes foreign flushes by the target wb's dirty pages
     instead of the memcg-wide count which over or undersized a single
     bdi flush.

   - nfsd READ emitted two fsnotify access events on the iterator path
     since vfs_iocb_iter_read() already sends one. A READ on a krb5i or
     krb5p mount showed up twice in inotify.

   - pipe and splice pass a poll key when waking readers and writers so
     epoll, poll() and select() waiters only wake for the event they
     asked for.

   - the iso8859-14 Unicode to charset tables had page01 duplicated as
     page1e so 29 code points mapped to the wrong bytes and 22 that
     aren't in the charset were accepted.

   - orangefs doesn't wait for an unmount service operation that never
     returns on system shutdown and uses ssize_t for strscpy() errors.

   - __register_chrdev() checks the kobject_set_name() return value.

   - selftest fixes: the openat2 tests hardcoded O_LARGEFILE to 0x8000
     which is O_NOFOLLOW on powerpc, resolve_test makes /tmp a
     mountpoint so RESOLVE_NO_XDEV has a boundary to trip over,
     file_stressor moves into its own directory with a 30 minute
     timeout, the kernfs listxattr test skips when SELinux exposes
     security.selinux, the namespaces active reference tests wait for
     the thread via a PIDFD_THREAD pidfd since pthread_join() returns
     before exit_nsproxy_namespaces(), the idmapped_tmpfile test chowns
     its directory into the mapped range, the clone3 CLONE_CLEAR_SIGHAND
     test adds CLONE_VM so it fails for the intended reason, the pidfd
     PPID error message prints the values it compares and fscontext_ns
     gets a .gitignore.

  Cleanups:

   - vmcore prints the release of the crashed kernel from the VMCOREINFO
     note so a kdump that dies before the dump lands still says which
     kernel it was for.

   - initramfs allocates hardlink hash entries with the validated cpio
     name length instead of PATH_MAX, which put every entry in
     kmalloc-8k.

   - the unused dax_layout_busy_page() is removed,
     dax_layout_busy_page_range() becomes static and dax_folio_init()
     drops a redundant list initialization.

   - vfs_empty_path() is removed, it has had no callers since
     getname_maybe_null().

   - comment and documentation fixes in aio, bpf_fs_kfuncs,
     fs-writeback, inode, read_write, squashfs and the vfs.rst copy of
     struct file_system_type"

* tag 'vfs-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (38 commits)
  selftests/filesystems: Fix idmapped_tmpfile layer dir ownership
  selftests/namespaces: Wait for thread exit via pidfd in active-ref tests
  writeback: size foreign flushes by target wb dirty pages
  initramfs: Reduce hardlink hash allocation sizes
  fs: remove unused vfs_empty_path()
  dcache: report a Tasks-RCU quiescent state in dentry_kill()
  vmcore: report the release of the crashed kernel
  splice: pass a poll key when waking pipe readers and writers
  pipe: pass a poll key when waking writers after a resize
  orangefs: use ssize_t instead of size_t for error codes...
  orangefs_super: don't wait on service operation on system shutdown.
  docs/vfs: Fix the struct file_system_type copy
  nls: fix the Unicode to charset tables of iso8859-14
  selftests/filesystems/openat2: make /tmp a mountpoint inside private namespace
  selftests/filesystems/openat2: fix O_LARGEFILE definitions for non-arm64 architectures
  fs: fix misleading comments in read_write.c
  squashfs: fix inode number description in documentation
  fs: fix typos in comments
  fs/dax: Make dax_layout_busy_page_range() static
  fs/dax: Remove unused dax_layout_busy_page()
  ...

Check that an immutable inode takes no write hint.

Link: https://patch.msgid.link/20261002-work-mount-fixes-4-v1-4-dd44b89d44ce@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

The file_stressor test requires a 30-minute timeout (1800 seconds) due to
its 15-minute runtime plus setup/teardown overhead. This is significantly
longer than the default 45-second timeout used by other filesystem tests.

Move file_stressor into its own subdirectory (filesystems/file_stressor/)
with a dedicated settings file to isolate its timeout configuration. This
prevents the long timeout from affecting other fast-running tests in the
filesystems/ directory.

This restructuring follows the pattern used by other selftests with special
requirements and ensures proper timeout handling in CI/CD environments
while maintaining the default 45-second timeout for other filesystem tests.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/all/202605192100.DvRgEGZ3-lkp@intel.com/
Signed-off-by: Disha Goel <disgoel@linux.ibm.com>
Link: https://patch.msgid.link/20260521101758.14639-1-disgoel@linux.ibm.com
Tested-by: Yeswanth Krishna <yeswanth@linux.ibm.com>
Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Pull vfs superblock updates from Christian Brauner:

 - Make it possible to share a block device between multiple
   filesystems.

   erofs can mount read-only blob devices shared between many
   superblocks, but because we only tracked a single superblock a
   freeze, thaw, removal or sync on such a device was never propagated
   to all the superblocks using it, and there was no way to find them.

   Add an efficient table to lookup all superblocks using a given block
   device.

 - A bunch of pre-existing fixes fell out of this work:

   A block-device freeze racing a btrfs device change could leave the
   whole filesystem stuck frozen. A bdev_freeze() issued by "dmsetup
   suspend" or an LVM snapshot resolves that holder to freeze the
   filesystem. and bdev_thaw() resolves it again to thaw. A freeze
   landing while btrfs is adding, removing or replacing a device freezes
   the filesystem. The membership change then drops that link. So the
   matching thaw could no longer find the superblock.

   Forbid freezing a device for the duration of a membership change,
   modelled on deny_write_access()/allow_write_access().

* tag 'vfs-7.3-rc1.super' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
  super: fix dying superblock warning messages
  block: reject block device inodes with i_rdev == 0 in lookup_bdev()
  selftests/filesystems: add ustat() coverage
  fs: look up the superblock via the device table in user_get_super()
  super: make fs_holder_ops private
  f2fs: open via dedicated fs bdev helpers
  erofs: open via dedicated fs bdev helpers
  fs: tolerate per-superblock freeze errors on shared devices
  fs: look up superblocks via the device table in fs_holder_ops
  ext4: open via dedicated fs bdev helpers
  btrfs: open via dedicated fs bdev helpers
  xfs: port to fs_bdev_file_open_by_path()
  fs: add dedicated block device open helpers for filesystems
  fs: maintain a global device-to-superblock table
  ocfs2: don't reset s_dev on dismount
  ext4: use anonymous devices for KUnit test superblocks
  fs, block: move blk_mode_t and fop_flags_t into <linux/types.h>
  super: take lock after last reference count
  super: convert s_count to refcount_t s_passive
  btrfs: deny freezing devices undergoing a replace
  ...

Add a regression test for the fsuidgid_has_mapping() check in
vfs_tmpfile().  It idmaps a detached tmpfs mount so that the
caller-visible id range [0, 10000) maps onto the on-disk range
[10000, 20000) and checks that:

  - a caller whose fsuid/fsgid fall outside that range cannot create an
    O_TMPFILE through the mount and gets -EOVERFLOW instead of an inode
    owned by (uid_t)-1;

  - a mapped caller can create an O_TMPFILE, link it into the namespace,
    and the ownership round-trips through the mount idmap: it is reported
    as 0 through the mount and stored as 10000 on the underlying tmpfs.

The test runs entirely as root and uses setfsuid()/setfsgid() to become
the unmapped caller, so it needs no helper user.  The layer directory is
world-writable so that an unmapped caller still clears the directory
permission check and reaches the fsuidgid_has_mapping() test.

Link: https://patch.msgid.link/20260615-work-idmapped-tmpfile-v1-2-754a94d81f83@kernel.org
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

user_get_super() is now backed by the global device-to-superblock table
instead of a walk of the super_blocks list. ustat(2) is its most direct
user-visible consumer but nothing in the tree exercises it.

Add a small regression test: the device number of a mounted tmpfs (an
anonymous device, registered in the table by sget_fc()) must resolve,
it must stop resolving after the unmount (the entry is dropped again in
kill_super_notify()), and bogus device numbers keep reporting EINVAL.

The test passes on kernels before the conversion: it pins down the
semantics the table-backed lookup must preserve.

Link: https://patch.msgid.link/20260616-work-super-bdev_holder_global-v2-18-7df6b864028e@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Link: https://lore.kernel.org/20250807-fscontext-log-cleanups-v3-2-8d91d6242dc3@cyphar.com
Signed-off-by: Christian Brauner <brauner@kernel.org>

Make sure that listxattr() returns zero and that getxattr() returns
ENODATA when no extended attributs are set. Use /sys/kernel/warn_count
as that always exists and is a read-only file.

Link: https://lore.kernel.org/20250702-hochmoderne-abklatsch-af9c605b57b2@brauner
Signed-off-by: Christian Brauner <brauner@kernel.org>

Test that anonymous inodes cannot be chown()ed.

Link: https://lore.kernel.org/20250407-work-anon_inode-v1-6-53a44c20d44e@kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>

Add a simple file stressor that lives directly in-tree. This will create
a bunch of processes that each open 500 file descriptors and then use
close_range() to close them all.

Concurrently, other processes read /proc/<pid>/fd/ which rougly does

    f = fget_task_next(p, &fd);
    if (!f)
           break;
    data.mode = f->f_mode;
    fput(f);

Which means that it'll try to get a reference to a file in another
task's file descriptor table.

Under heavy file load it is increasingly likely that the other task will
manage to close @file and @file will be recycled due to
SLAB_TYPEAFE_BY_RCU concurrently. This will trigger various warnings in
the file reference counting code.

Link: https://lore.kernel.org/r/20241021-vergab-streuen-924df15dceb9@brauner
Signed-off-by: Christian Brauner <brauner@kernel.org>