Merge tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

 - writeback:

    - Update dirtied_when instead of dirtied_time_when when a wb switch
      puts an inode at the newest end of the target b_dirty list. The
      list was left out of order so move_expired_inodes() could stop
      before older inodes, and the lazytime expiration timestamp was
      reset

    - Clear the old wb's dirty-I/O state and bandwidth contribution when
      a batch of inode switches leaves its dirty lists empty. An empty
      wb stayed scheduled for periodic writeback and inflated
      bdi->tot_write_bandwidth

    - Take wb_switch_rwsem across the inode scan of
      cleanup_offline_cgwb(). The v7.3-rc5 fix that rotates scanned
      inodes let a scan racing a sync()'s queue_io() move lazytime
      inodes past the sync's cutoff, so sync() returned without
      persisting their timestamps

    - Don't kick writeback for an IOCB_DONTCACHE write on an inode that
      has no wb yet. With cgroup writeback an O_DIRECT RWF_DONTCACHE
      write to a block device dereferenced NULL

 - statmount/listmount/listns:

    - Refuse statmount() string requests with a buffer that isn't larger
      than struct statmount

    - Don't wrap around with a U64_MAX cursor in listmount() and
      listns()

    - Don't end listns() at an inactive namespace

    - Only add init_ipc_ns and init_net to the namespace trees if
      CONFIG_IPC_NS and CONFIG_NET_NS are enabled

 - iomap:

    - Only mark blocks uptodate in __iomap_write_begin() after reading
      them and let __iomap_write_end() mark the zeroed blocks uptodate
      once the copy from userspace succeeded

    - Check a chunk against max_integrity_io_size() on its own before
      the bio size check

    - Only enforce block alignment for direct I/O into holes and
      unwritten extents if IOMAP_DIO_FSBLOCK_ALIGNED is set

 - backing-file:

    - Check S_APPEND and S_IMMUTABLE on the backing inode. FUSE
      passthrough opens the backing file with vfs_open() which skips
      may_open(), so anyone who may open the FUSE file for writing could
      overwrite an append-only backing file anywhere or write to an
      immutable one. Open, mmap and writes now check the backing inode
      the way may_open() and do_mmap() do

    - Always call kiocb_end_write() for a queued write

    - Let backing files inherit FMODE_NONOTIFY from the user file. The
      event fds fanotify creates for permission events on a stacked
      filesystem raised FS_OPEN_PERM on the real path from inside the
      listener's read() and deadlocked listeners with marks on both
      layers

 - pidfs:

    - Look the task up before checking for exit information in
      PIDFD_GET_INFO and start over if the task no longer owns the pid
      once all fields have been read. A caller racing release_task() got
      neither PIDFD_INFO_PID nor PIDFD_INFO_EXIT or ESRCH although the
      exit information was available, and a caller racing a sub-thread's
      exec reported that thread's tid as the pid

    - Clear the mask bits of fields that lie beyond the struct size the
      caller passed. The uapi header promises that the mask names no
      such field but a caller passing PIDFD_INFO_SIZE_VER0 got the
      coredump and supported mask bits set for fields that were never
      written

 - aio:

    - Give the aio ring a ->read_folio that fails with EIO so a fault on
      a ring whose file was truncated gets SIGBUS instead of jumping to
      NULL

    - Check nr_events against the ring size before doubling it in
      ioctx_alloc()

 - splice:

    - Only write back an implicit file position in do_splice() when the
      splice helper succeeded. splice doesn't take f_pos_lock so a
      failed splice restored a stale snapshot over a position that a
      concurrent getdents() had moved. On ext2 the next readdir then
      trusted an offset inside a directory entry

    - Retry tee() when the input pipe was emptied or the output pipe
      filled between the prep steps and link_pipe() instead of returning
      0 while the input pipe still has writers, as splice_pipe_to_pipe()
      does

 - ucount:

    - Take the reference that pins a ucounts level on the 0 -> 1
      transition before checking the rlimit

    - Read the parent ucounts before dropping the rlimit count in
      do_dec_rlimit_put_ucounts()

 - inode:

    - Rotate inodes whose page cache couldn't be dropped to the tail of
      the LRU

    - Skip inodes that another LRU walker is isolating

 - setns:

    - Set nsset->flags before anything in prepare_nsset() can fail so
      the error path drops the cred prepared for CLONE_NEWUSER. A
      failing setns() with CLONE_NEWUSER and CLONE_NEWNS leaked it
      together with its user namespace

    - Refuse setns(CLONE_NEWNS) for a task that shares its fs_struct
      again when more namespaces are requested

 - minix:

    - Restore uptodate on the pinned bitmap buffers before redirtying
      them after a failed writeback instead of tripping the warning in
      mark_buffer_dirty(), as ext2 and ext4 do for their superblock
      buffers

    - Reject rmdir() of a directory with a corrupted link count with
      EFSCORRUPTED instead of hitting the drop_nlink() warning

 - userns: Keep the exec securebits and their locks when creating or
   joining a user namespace. set_cred_user_ns() reset all securebits to
   SECUREBITS_DEFAULT so anyone who may create a user namespace could
   shed SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE with
   a single unshare(CLONE_NEWUSER)

 - fs: Honor FOP_UNSIGNED_OFFSET in sys_llseek() and in the pread64(),
   pwrite64(), preadv() and pwritev() wrappers

 - proc/kcore: Advance the vmalloc retry in read_kcore_iter() by the
   last vread_iter() copy instead of the running total

 - eventpoll: Return the error when the wakeup source for EPOLLWAKEUP
   can't be created in EPOLL_CTL_MOD instead of reporting success
   without suspend protection

 - coredump: Mark do_coredump() noinline_for_stack

 - nsfs: Check the trailing bytes of a namespace file handle in bytes
   instead of words

 - netfs: Restore the per-level and per-point decoding of the debug mask

 - exportfs: Release the directory file get_name() opened with
   __fput_sync(). From nfsd's kernel threads the deferred fputs arrived
   faster than delayed_fput retired them and each pinned the directory's
   readdir state, growing unreclaimable slab by about 90 MB per second
   under a parallel tree walk

 - fs: Call ramfs_kill_sb() for a ramfs rootfs. Since rootfs can be
   unmounted as of v7.0 its struct ramfs_fs_info was leaked

 - signal: Check the blocked mask for every entry
   dequeue_synchronous_signal() looks at. The scan could select a
   blocked synchronous signal and deliver it while blocked

 - super: Convert the superblock device table from an rhltable to a
   plain hashtable under a spinlock. This fixes a bug from v7.3 where
   fs_bdev_freeze() froze a btrfs filesystem through a stale member that
   open_ctree() had already released while the freeze was waiting for
   SB_BORN

 - fork: Leave rcu_users at zero until copy_process() can't fail
   anymore. bpf_task_acquire() handed out trusted references to the new
   task from the task_alloc LSM hook and sched_ext's ops.init_task() and
   a failing fork freed the task behind them

 - xattr: Always run cap_convert_nscap() for a security.capability
   write. A zero-length setxattr() skipped it and let an unprivileged
   caller without CAP_SETFCAP or write permission on the file plant an
   empty security.capability xattr that made every execve() of the
   binary fail with EINVAL

 - namei: Skip the S_ISDIR assertion in

 - proc: Refuse to mount on entries below /proc/<pid>/net like fd/,
   fdinfo/ and map_files/. proc_net_d_revalidate() always fails so the
   first lookup by anyone with search permission ran d_invalidate() on
   the dentry and detached every mount on it, locked mounts included

 - libfs: Hold one mount reference for all pins instead of one per pin.
   The pin count is what keeps the mount alive, so the per-pin reference
   only cost a mntget() and a mntput() through
   mntput_no_expire_slowpath() for every debugfs, tracefs, securityfs or
   configfs file that comes and goes

 - iov_iter: Return 0 from iov_iter_alignment() for an empty iterator of
   any type

 - watch_queue: Give info_id its own storage instead of overlaying it
   with rcu_head

 - filelock: Take an active superblock reference while waiting for a
   delegation break. After a lazy umount closing the delegation holder
   could shut down the superblock under the waiter whose final iput()
   then ran shmem_evict_inode() on freed state

 - fs: Skip the copy_file_range() write limit checks when there is no
   data to copy

 - bpf: Allow bpf_d_path() from fentry on filp_close_sync(). Since
   close_range() became synchronous this cycle close(), close_range()
   and the closes on exec and exit no longer go through filp_close().
   fexit stays rejected since the file may be gone by then

 - fs_pin: Dequeue the wait entry unconditionally in pin_kill(). A
   spuriously woken waiter kept its on-stack entry queued, took that as
   proof that the pin was alive and used the freed acct structure when
   umount() of the accounting file raced acct(2)

 - dcache: Don't fail __d_obtain_alias() for an inode without links and
   aliases. The ESTALE check added this cycle broke open_by_handle_at()
   and nfsd file handle decoding on NFS and FUSE where i_nlink is just
   what the server last reported and the handle may well still be valid

 - selftests/ovl: Fix the mountinfo expectations of the detached layer
   test which has failed since it was added

* tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (60 commits)
  fs: don't fail __d_obtain_alias() for unlinked inodes
  ns: don't add init_ipc_ns and init_net without namespace support
  aio: avoid request count overflow in ioctx_alloc()
  selftests/ovl: fix detached layer mountinfo expectations
  bpf: Allow bpf_d_path() from filp_close_sync()
  fs: skip copy_file_range write limits when there is no data
  minix: reject rmdir of a directory with a corrupted link count
  fs_pin: do not trust the pin after a spurious wakeup in pin_kill()
  ucount: read the parent ucounts before dropping the rlimit count
  splice: retry tee() instead of returning 0 when it races
  selftests/pidfd: test that fields beyond the struct size are not reported
  pidfs: do not report fields that do not fit into the caller's struct
  fs: let backing files inherit FMODE_NONOTIFY from the user file
  splice: avoid stale f_pos writeback on error
  backing-file: always end a queued write
  filelock: keep superblock active through delegation wait
  watch_queue: keep info_id separate from rcu_head
  iomap: only follow dio alignment requirement if specified
  iov_iter: fix NULL deref in iov_iter_alignment()
  backing-file: enforce append-only and immutable backing inodes
  ...

0 files changed, 0 insertions, 0 deletions