Merge tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

1dbb7422 · Linus Torvalds <[email protected]> · 2026-10-16 07:53:16 -07:00

Pull vfs fixes from Christian Brauner:

 - Fix a range of use-after-frees during rcu pathwalk caused by non-rcu
   frees.

   Whatever ->permission(), ->d_revalidate(), ->get_link(), ->d_hash()
   and ->d_compare() read in rcu mode has to be freed after a grace
   period. umount(2) hides most of it because namespace_unlock() waits
   for one, but a chdir() out of a lazily unmounted directory or the
   close() of the last file on it drops the last reference without.

    * ext4_get_link() reads the sbi and the extent status counters for a
      symlink stored in a data block. Both are freed after a grace
      period now.

    * The unicode map of casefolded ext4, f2fs and tmpfs was freed under
      generic_ci_d_hash() and generic_ci_d_compare().

    * ntfs3 with nocase freed its sbi and mount options under its dentry
      hash and compare. A remount freed the old options right away too.

    * eventfs freed an eventfs_inode after an SRCU grace period only
      while tracefs_d_revalidate() reads it under rcu_read_lock().

    * afs and 9p are only saved by the grace period their private bdi
      gets in bdi_unregister(). They stop depending on it.

    * create_ipc_ns() leaked the mqueue mount and its superblock on a
      late failure. A long-term mount needs kern_unmount().

 - Don't let idle threads pin the initramfs.

   The idle threads of the secondary cpus are forked from PID 1 with a
   private copy of its fs_struct, aren't on the task list so
   pivot_root() never moves them and never exit. So the initramfs stayed
   pinned forever on every machine with more than one cpu, 70 to 150 MB
   in the reports. They share init_fs now like init_task does.

 - A mount that copy_tree() leaves out can't take over a lock.

   copy_tree() drops mounts of mount namespace files from the copies it
   makes for unshare(CLONE_NEWNS) and propagation without looking at
   MNT_LOCKED. So root in a user namespace could bind a child's
   /proc/<pid>/ns/mnt beneath a locked cover, let it take the lock over,
   unshare(CLONE_NEWNS) and read the file. copy_tree() refuses with
   EPERM now and the move beneath a locked mount is refused up front.

 - Revert "namei: don't reveal overmounted entries in refwalk" from the
   rc7 fixes. The bug class is bigger than that patch.

 - namei: lookup_fast_for_open() checked ->d_inode while
   traverse_mounts() checks the type in d_flags, which is set second, so
   a refwalk racing the instantiation could fail an O_CREAT open with
   ENOENT. Use d_is_negative() in both places.

 - Drop the smp_mb()s in mntput_no_expire_slowpath() and do_umount()
   that mnt_get_count()'s own barrier made redundant.

 - fsnotify: a mark added while fsnotify_destroy_marks() walks the
   connector could be missed and the connector detached, so an fdinfo
   read called igrab(NULL). New marks are refused during teardown.

 - pipe: a failed second fasync enable on an O_RDWR FIFO removed the
   existing reader entry and cleared FASYNC while the writer entry
   stayed, a use-after-free in send_sigio() later.

 - watch_queue: post_one_notification() could see nr_notes before the
   note pool behind it and dereference a NULL array. An unprivileged
   user can trigger that with a key watch. Publish nr_notes last.

 - pid_namespace: zap_pid_ns_processes() waits without bound for a
   tracer outside the namespace to reap its zombies and neither wait was
   freezable, so every suspend attempt failed.

 - exit: is_child_subreaper and has_child_subreaper shared a word with
   other bitfields written without a common lock, so racing prctl()s
   lost a bit. They are separate bools now.

 - autofs: a notification write that failed on a pipe the daemon had
   already replaced put the superblock into catatonic mode again and
   closed the replacement. Only do that for the current pipe.

 - ovl: reject a lowerdir ending with an unescaped backslash with EINVAL
   instead of a confusing ENOENT later.

 - ocfs2/dlm: take dlm_reco_state_lock when the debugfs state file walks
   the recovery participant list.

 - samples/pidfd: fix the userprogs typo that kept pidfd-metadata from
   being built.

* tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
  Revert "namei: don't reveal overmounted entries in refwalk"
  selftests/filesystems: test that a mntns file can't take over a lock
  fs: let idle threads share init_fs
  namespace: a mount that copy_tree() leaves out can't take over a lock
  namei: test for a negative dentry the way traverse_mounts() does
  fs: pass flags to copy_fs()
  ovl: reject lowerdir ending with unescaped backslash
  fsnotify: prevent mark additions during connector teardown
  pid_namespace: make zap_pid_ns_processes() freezable
  fs: drop the smp_mb()s that mnt_get_count() made redundant
  autofs: ignore notification errors from a replaced pipe
  ntfs3: free replaced mount options after a grace period
  ntfs3: free the sbi after a grace period
  unicode: free the map after a grace period
  ipc: drop the mqueue mount with kern_unmount() on setup failure
  eventfs: free the eventfs_inode after an rcu grace period too
  9p: free the session after a grace period
  watch_queue: Fix note pool publication race in watch_queue_set_size()
  afs: free the super info after a grace period
  pipe: preserve existing fasync readers on writer setup failure
  ...

Commit

1dbb7422053fa0f4fb5f9acc3931617fc0091939

Parents

519abe8d · 214897ac

Merge commit. Changes below are compared with the first parent: 519abe8d.

Changes

34 files changed · +325 −92