[git pull] vfs.git fixes

[git pull] vfs.git fixes

[Al Viro]

	Assorted fixes all over the place.  BTW, what is the preferred way
of sending a pull request on a series where an old commit has grown an
ACKed-by?  I've moved original branch to #fixes-old, git commit --amend
on commit[s] in question and rebased the tail of the series on top of that;
all trees involved are identical to ones in matching commits in original
branch, so all testing results (including integration in -next, etc.) are
still valid.  Is that approach OK with you?  Technically it is a rebase,
but it seems that none of the usual objections apply here...

The following changes since commit 16a34adb9392b2fe4195267475ab5b472e55292c:

  Don't leak MNT_INTERNAL away from internal mounts (2018-04-19 23:52:15 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

for you to fetch changes up to baf10564fbb66ea222cae66fbff11c444590ffd9:

  aio: fix io_destroy(2) vs. lookup_ioctx() race (2018-05-21 14:30:11 -0400)

----------------------------------------------------------------
Al Viro (11):
      do d_instantiate/unlock_new_inode combinations safely
      fix breakage caused by d_find_alias() semantics change
      affs_lookup(): close a race with affs_remove_link()
      affs_lookup: switch to d_splice_alias()
      befs_lookup(): use d_splice_alias()
      kernfs: deal with kernfs_fill_super() failures
      unfuck sysfs_mount()
      cachefiles: vfs_mkdir() might succeed leaving dentry negative unhashed
      nfsd: vfs_mkdir() might succeed leaving dentry negative unhashed
      ext2: fix a block leak
      aio: fix io_destroy(2) vs. lookup_ioctx() race

Dave Chinner (1):
      fs: don't scan the inode cache before SB_BORN is set

Ilya Dryomov (2):
      iov_iter: fix return type of __pipe_get_pages()
      iov_iter: fix memory leak in pipe_get_pages_alloc()

Joe Perches (1):
      cramfs: Fix IS_ENABLED typo

 fs/affs/namei.c          | 15 +++++++++------
 fs/aio.c                 |  4 ++--
 fs/befs/linuxvfs.c       | 17 +++++------------
 fs/btrfs/inode.c         | 16 ++++------------
 fs/cachefiles/namei.c    | 10 ++++++++++
 fs/cramfs/inode.c        |  2 +-
 fs/dcache.c              | 22 ++++++++++++++++++++++
 fs/ecryptfs/inode.c      |  3 +--
 fs/ext2/inode.c          | 10 ----------
 fs/ext2/namei.c          |  6 ++----
 fs/ext4/namei.c          |  6 ++----
 fs/f2fs/namei.c          | 12 ++++--------
 fs/jffs2/dir.c           | 12 ++++--------
 fs/jfs/namei.c           | 12 ++++--------
 fs/kernfs/mount.c        |  1 +
 fs/nfsd/vfs.c            | 22 ++++++++++++++++++++++
 fs/nilfs2/namei.c        |  6 ++----
 fs/orangefs/namei.c      |  9 +++------
 fs/reiserfs/namei.c      | 12 ++++--------
 fs/super.c               | 30 ++++++++++++++++++++++++------
 fs/sysfs/mount.c         |  6 +++---
 fs/udf/namei.c           |  6 ++----
 fs/ufs/namei.c           |  6 ++----
 include/linux/dcache.h   |  1 +
 lib/iov_iter.c           |  4 ++--
 security/selinux/hooks.c | 20 ++++++++++++++++----
 26 files changed, 152 insertions(+), 118 deletions(-)

Re: [git pull] vfs.git fixes

[Linus Torvalds]

On Mon, May 21, 2018 at 11:39 AM Al Viro <viro@zeniv.linux.org.uk> wrote:

>            BTW, what is the preferred way
> of sending a pull request on a series where an old commit has grown an
> ACKed-by?  I've moved original branch to #fixes-old, git commit --amend
> on commit[s] in question and rebased the tail of the series on top of
that;

That's exactly the same as just doing a "git rebase -i <commit>^" where
'commit' is the thing you want to amend, and then just picking that for 'r'
('reword').

In general, I'd prefer people not do it, unless there is a very strong
reason to reword the commit message. I'm not sure just an ack is
necessarily reason enough.

Anyway, pulled.

            Linus

Re: [git pull] vfs.git fixes

[pr-tracker-bot]

The pull request you sent on Fri, 10 Mar 2023 20:27:37 +0000:

> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git tags/pull-fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/4831f76247bc939ed1b6d71ddd23337ec8b56b8e

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

[git pull] vfs.git fixes

[Al Viro]

fs/file.c one is a genuine missing speculation barrier in pick_file() (reachable
e.g. via close(2)); alpha one is strictly speaking not a bug fix, but only
because confusion between preempt_enable() and preempt_disable() is harmless
on architecture without CONFIG_PREEMPT.  Looks like alpha.git picked the
wrong version of patch - that braino used to be there in early versions, but
it had been fixed quite a while ago...  I've checked what ended up in mainline,
fortunately all other parts of commit match the latest variant in my tree.

The following changes since commit fe15c26ee26efa11741a7b632e9f23b01aca4cc6:

  Linux 6.3-rc1 (2023-03-05 14:52:03 -0800)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git tags/pull-fixes

for you to fetch changes up to 609d54441493c99f21c1823dfd66fa7f4c512ff4:

  fs: prevent out-of-bounds array speculation when closing a file descriptor (2023-03-09 22:46:21 -0500)

----------------------------------------------------------------
pick_file() speculation fix + fix for alpha mis(merge,cherry-pick)

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

----------------------------------------------------------------
Al Viro (1):
      alpha: fix lazy-FPU mis(merged/applied/whatnot)

Theodore Ts'o (1):
      fs: prevent out-of-bounds array speculation when closing a file descriptor

 arch/alpha/lib/fpreg.c | 4 ++--
 fs/file.c              | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

Re: [git pull] vfs.git fixes

[pr-tracker-bot]

The pull request you sent on Sun, 17 Jan 2021 03:21:15 +0000:

> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/a527a2b32d20a2bd8070f49e98cb1a89b0c98bb3

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

[git pull] vfs.git fixes

[Al Viro]

	Several assorted fixes.  I still think that audit ->d_name race
is better fixed that way for the benefit of backports, with any fancier
variants done on top of that.

The following changes since commit 5c8fe583cce542aa0b84adc939ce85293de36e5e:

  Linux 5.11-rc1 (2020-12-27 15:30:22 -0800)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

for you to fetch changes up to d36a1dd9f77ae1e72da48f4123ed35627848507d:

  dump_common_audit_data(): fix racy accesses to ->d_name (2021-01-16 15:11:35 -0500)

----------------------------------------------------------------
Al Viro (2):
      umount(2): move the flag validity checks first
      dump_common_audit_data(): fix racy accesses to ->d_name

Christoph Hellwig (1):
      iov_iter: fix the uaccess area in copy_compat_iovec_from_user

 fs/namespace.c       | 7 +++++--
 lib/iov_iter.c       | 2 +-
 security/lsm_audit.c | 7 +++++--
 3 files changed, 11 insertions(+), 5 deletions(-)

Re: [git pull] vfs.git fixes

[pr-tracker-bot]

The pull request you sent on Sun, 11 Oct 2020 19:06:09 +0100:

> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/5b697f86f9f136d200c9827d6eca0437b7eb96cf

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

[git pull] vfs.git fixes

[Al Viro]

	Sat in -next for a while, fixes an obvious bug
(leak introduced in 5.8, i.e. the mess from previous cycle).

The following changes since commit 933a3752babcf6513117d5773d2b70782d6ad149:

  fuse: fix the ->direct_IO() treatment of iov_iter (2020-09-17 17:26:56 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

for you to fetch changes up to 8a018eb55e3ac033592afbcb476b0ffe64465b12:

  pipe: Fix memory leaks in create_pipe_files() (2020-10-01 09:40:35 -0400)

----------------------------------------------------------------
Qian Cai (1):
      pipe: Fix memory leaks in create_pipe_files()

 fs/pipe.c                   | 11 +++++------
 include/linux/watch_queue.h |  6 ++++++
 2 files changed, 11 insertions(+), 6 deletions(-)

Re: [git pull] vfs.git fixes

[pr-tracker-bot]

The pull request you sent on Tue, 28 Apr 2020 22:18:55 +0100:

> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/96c9a7802af7d500a582d89a8b864584fe878c1b

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.wiki.kernel.org/userdoc/prtracker

[git pull] vfs.git fixes

[Al Viro]

	Two old bugs...

The following changes since commit 8f3d9f354286745c751374f5f1fcafee6b3f3136:

  Linux 5.7-rc1 (2020-04-12 12:35:55 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

for you to fetch changes up to b0d3869ce9eeacbb1bbd541909beeef4126426d5:

  propagate_one(): mnt_set_mountpoint() needs mount_lock (2020-04-27 10:37:14 -0400)

----------------------------------------------------------------
Al Viro (2):
      dlmfs_file_write(): fix the bogosity in handling non-zero *ppos
      propagate_one(): mnt_set_mountpoint() needs mount_lock

 fs/ocfs2/dlmfs/dlmfs.c | 27 ++++++++++++---------------
 fs/pnode.c             |  9 ++++-----
 2 files changed, 16 insertions(+), 20 deletions(-)

Re: [git pull] vfs.git fixes

[pr-tracker-bot]

The pull request you sent on Thu, 12 Mar 2020 22:37:09 +0000:

> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/807f030b44ccbb26a346df6f6438628315d9ad98

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.wiki.kernel.org/userdoc/prtracker

[git pull] vfs.git fixes

[Al Viro]

	A couple of fixes for old crap in ->atomic_open() instances.

The following changes since commit bf4498ad3f9a0f7202cf90e52b5ce9bb31700b91:

  tmpfs: deny and force are not huge mount options (2020-02-18 15:07:30 -0500)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

for you to fetch changes up to d9a9f4849fe0c9d560851ab22a85a666cddfdd24:

  cifs_atomic_open(): fix double-put on late allocation failure (2020-03-12 18:25:20 -0400)

----------------------------------------------------------------
Al Viro (2):
      gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
      cifs_atomic_open(): fix double-put on late allocation failure

 Documentation/filesystems/porting.rst | 8 ++++++++
 fs/cifs/dir.c                         | 1 -
 fs/gfs2/inode.c                       | 2 +-
 fs/open.c                             | 3 ---
 4 files changed, 9 insertions(+), 5 deletions(-)

Re: [git pull] vfs.git fixes

[pr-tracker-bot]

The pull request you sent on Mon, 24 Feb 2020 00:22:41 +0000:

> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/bc570c14b260946a66e13882eace862dc6eb16f8

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.wiki.kernel.org/userdoc/prtracker

[git pull] vfs.git fixes

[Al Viro]

	Regression from fs_parse series this cycle...

The following changes since commit bb6d3fb354c5ee8d6bde2d576eb7220ea09862b9:

  Linux 5.6-rc1 (2020-02-09 16:08:48 -0800)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

for you to fetch changes up to bf4498ad3f9a0f7202cf90e52b5ce9bb31700b91:

  tmpfs: deny and force are not huge mount options (2020-02-18 15:07:30 -0500)

----------------------------------------------------------------
Hugh Dickins (1):
      tmpfs: deny and force are not huge mount options

 mm/shmem.c | 2 --
 1 file changed, 2 deletions(-)

Re: [git pull] vfs.git fixes

[pr-tracker-bot]

The pull request you sent on Sun, 26 Jan 2020 18:25:17 +0000:

> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/b1b298914f3ae226e99c98042c1648f740015724

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.wiki.kernel.org/userdoc/prtracker

[git pull] vfs.git fixes

[Al Viro]

	Fixes a use-after-free in do_last() handling of sysctl_protected_... checks.
UAF normally doesn't happen there, but race with rename() and it becomes possible.

The following changes since commit 508c8772760d4ef9c1a044519b564710c3684fc5:

  fix autofs regression caused by follow_managed() changes (2020-01-15 01:36:46 -0500)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

for you to fetch changes up to d0cb50185ae942b03c4327be322055d622dc79f6:

  do_last(): fetch directory ->i_mode and ->i_uid before it's too late (2020-01-26 09:31:07 -0500)

----------------------------------------------------------------
Al Viro (1):
      do_last(): fetch directory ->i_mode and ->i_uid before it's too late

 fs/namei.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

Re: [git pull] vfs.git fixes

[pr-tracker-bot]

The pull request you sent on Sun, 24 Nov 2019 20:05:53 +0000:

> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/b8387f6f34952c09fe9a9f6e4be027f8b16cfd18

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.wiki.kernel.org/userdoc/prtracker

[git pull] vfs.git fixes

[Al Viro]

	Regression fix, fallen through the cracks.
The following changes since commit 762c69685ff7ad5ad7fee0656671e20a0c9c864d:

  ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either (2019-11-10 11:57:45 -0500)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

for you to fetch changes up to 3e5aeec0e267d4422a4e740ce723549a3098a4d1:

  cramfs: fix usage on non-MTD device (2019-11-23 21:44:49 -0500)

----------------------------------------------------------------
Maxime Bizon (1):
      cramfs: fix usage on non-MTD device

 fs/cramfs/inode.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Re: [git pull] vfs.git fixes

[pr-tracker-bot]

The pull request you sent on Fri, 15 Nov 2019 00:50:12 +0000:

> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/b4c0800e4285f96900b7aa4a13ae724fc1205f65

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.wiki.kernel.org/userdoc/prtracker

[git pull] vfs.git fixes

[Al Viro]

	Assorted fixes all over the place; some of that is -stable
fodder, some - regressions from the last window.

The following changes since commit 4f5cafb5cb8471e54afdc9054d973535614f7675:

  Linux 5.4-rc3 (2019-10-13 16:37:36 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

for you to fetch changes up to 762c69685ff7ad5ad7fee0656671e20a0c9c864d:

  ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either (2019-11-10 11:57:45 -0500)

----------------------------------------------------------------
Al Viro (7):
      autofs: fix a leak in autofs_expire_indirect()
      cgroup: don't put ERR_PTR() into fc->root
      exportfs_decode_fh(): negative pinned may become positive without the parent locked
      audit_get_nd(): don't unlock parent too early
      ecryptfs: fix unlink and rmdir in face of underlying fs modifications
      ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable
      ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either

Eric Biggers (1):
      fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry()

Guillem Jover (1):
      aio: Fix io_pgetevents() struct __compat_aio_sigset layout

 fs/aio.c               | 10 +++---
 fs/autofs/expire.c     |  5 +--
 fs/ecryptfs/inode.c    | 84 +++++++++++++++++++++++++++++++-------------------
 fs/exportfs/expfs.c    | 31 +++++++++++--------
 fs/namespace.c         | 15 +++++----
 kernel/audit_watch.c   |  2 +-
 kernel/cgroup/cgroup.c |  5 +--
 7 files changed, 91 insertions(+), 61 deletions(-)

Re: [git pull] vfs.git fixes

[pr-tracker-bot]

The pull request you sent on Sun, 5 May 2019 03:18:46 +0100:

> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/51987affd626b8e4ce9f4c65e1950cb9159f0f58

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.wiki.kernel.org/userdoc/prtracker

[git pull] vfs.git fixes

[Al Viro]

	A couple of ->i_link use-after-free fixes, regression fix for
wrong errno on absent device name in mount(2) (this cycle stuff) +
ancient UFS braino in large GID handling on Solaris UFS images (bogus
cut'n'paste from large UID handling; wrong field checked to decide
whether we should look at old (16bit) or new (32bit) field).

The following changes since commit 6af1c849dfb1f1d326fbdd157c9bc882b921f450:

  aio: use kmem_cache_free() instead of kfree() (2019-04-04 20:13:59 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

for you to fetch changes up to 4e9036042fedaffcd868d7f7aa948756c48c637d:

  ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour (2019-05-02 02:24:50 -0400)

----------------------------------------------------------------
Al Viro (4):
      securityfs: fix use-after-free on symlink traversal
      apparmorfs: fix use-after-free on symlink traversal
      [fix] get rid of checking for absent device name in vfs_get_tree()
      ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour

Alexander Lochmann (1):
      Abort file_remove_privs() for non-reg. files

 fs/inode.c                     |  9 +++++++--
 fs/super.c                     |  5 -----
 fs/ufs/util.h                  |  2 +-
 security/apparmor/apparmorfs.c | 13 +++++++++----
 security/inode.c               | 13 +++++++++----
 5 files changed, 26 insertions(+), 16 deletions(-)

Re: [git pull] vfs.git fixes

[pr-tracker-bot]

The pull request you sent on Sun, 3 Mar 2019 03:42:53 +0000:

> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/4f9020ffde71ddb92bc2f65ce0b00232bc88c590

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.wiki.kernel.org/userdoc/prtracker

Re: [git pull] vfs.git fixes

[Linus Torvalds]

On Sat, Mar 2, 2019 at 7:43 PM Al Viro <viro@zeniv.linux.org.uk> wrote:
>
>         Assorted fixes that sat in -next for a while, all over the
> place.

Is this for the merge window or _very_ late fixes for 5.0?

One of the commits doesn't look appropriate for this (very late) stage
of the rc series: "cgroup: saner refcounting for cgroup_root" seems to
be a pure cleanup, and not one that matters for subsequent fixes.

And the string length one looks sane, but not exactly critical.

I'm getting the feeling that this is for the merge window, but wanted to verify.

                   Linus

[git pull] vfs.git fixes

[Al Viro]

	Assorted fixes that sat in -next for a while, all over the
place.

The following changes since commit 1c7fc5cbc33980acd13d668f1c8f0313d6ae9fd8:

  Linux 5.0-rc2 (2019-01-14 10:41:12 +1200)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

for you to fetch changes up to d3d6a18d7d351cbcc9b33dbedf710e65f8ce1595:

  aio: Fix locking in aio_poll() (2019-02-21 22:16:47 -0500)

----------------------------------------------------------------
Al Viro (2):
      fix cgroup_do_mount() handling of failure exits
      cgroup: saner refcounting for cgroup_root

Bart Van Assche (1):
      aio: Fix locking in aio_poll()

Chandan Rajendra (1):
      copy_mount_string: Limit string length to PATH_MAX

YueHaibing (1):
      exec: Fix mem leak in kernel_read_file

 fs/aio.c                        | 12 ++++++---
 fs/exec.c                       |  2 +-
 fs/kernfs/mount.c               |  8 ++++--
 fs/namespace.c                  |  2 +-
 kernel/cgroup/cgroup-internal.h |  2 +-
 kernel/cgroup/cgroup-v1.c       | 58 +++++++++--------------------------------
 kernel/cgroup/cgroup.c          | 25 +++++++++---------
 7 files changed, 44 insertions(+), 65 deletions(-)

Re: [git pull] vfs.git fixes

[pr-tracker-bot]

The pull request you sent on Fri, 30 Nov 2018 05:15:22 +0000:

> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/5f1ca5c619c2af5e03114b0276642cdc15d11a94

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.wiki.kernel.org/userdoc/prtracker

[git pull] vfs.git fixes

[Al Viro]

Assorted fixes all over the place; iov_iter one is this cycle regression
(splice from UDP triggering WARN_ON()), the rest is older.

The following changes since commit 651022382c7f8da46cb4872a545ee1da6d097d2a:

  Linux 4.20-rc1 (2018-11-04 15:37:52 -0800)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

for you to fetch changes up to 73116df7bb90435ccb2817f44113295240d15034:

  afs: Use d_instantiate() rather than d_add() and don't d_drop() (2018-11-29 21:08:14 -0500)

----------------------------------------------------------------
Al Viro (1):
      iov_iter: teach csum_and_copy_to_iter() to handle pipe-backed ones

David Howells (3):
      afs: Fix validation/callback interaction
      afs: Fix missing net error handling
      afs: Use d_instantiate() rather than d_add() and don't d_drop()

Jens Axboe (1):
      aio: fix failure to put the file pointer

Pan Bian (1):
      exportfs: do not read dentry after free

YueHaibing (2):
      sysv: return 'err' instead of 0 in __sysv_write_inode
      exportfs: fix 'passing zero to ERR_PTR()' warning

 fs/afs/dir.c        |  4 +---
 fs/afs/fs_probe.c   | 39 ++++++++++++++++++++++++---------------
 fs/afs/inode.c      | 18 ++++++++++++------
 fs/afs/internal.h   |  9 +++++++++
 fs/afs/misc.c       | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 fs/afs/rotate.c     | 53 +++++++++++++----------------------------------------
 fs/afs/vl_probe.c   | 45 +++++++++++++++++++++++++++------------------
 fs/afs/vl_rotate.c  | 50 ++++++++++----------------------------------------
 fs/aio.c            |  1 +
 fs/exportfs/expfs.c |  3 ++-
 fs/sysv/inode.c     |  2 +-
 lib/iov_iter.c      | 38 +++++++++++++++++++++++++++++++++++++-
 12 files changed, 189 insertions(+), 125 deletions(-)

[git pull] vfs.git fixes

[Al Viro]

	A bunch of race fixes, mostly around lazy pathwalk.  All of that
is -stable fodder, large part going back to 2013 ;-/

The following changes since commit 9ba546c01976a426292af99e682a557075d6c010:

  aio: don't expose __aio_sigset in uapi (2018-07-17 23:26:58 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes

for you to fetch changes up to 4c0d7cd5c8416b1ef41534d19163cb07ffaa03ab:

  make sure that __dentry_kill() always invalidates d_seq, unhashed or not (2018-08-09 18:07:15 -0400)

----------------------------------------------------------------
Al Viro (4):
      root dentries need RCU-delayed freeing
      fix mntput/mntput race
      fix __legitimize_mnt()/mntput() race
      make sure that __dentry_kill() always invalidates d_seq, unhashed or not

 fs/dcache.c    | 13 ++++++-------
 fs/namespace.c | 28 ++++++++++++++++++++++++++--
 2 files changed, 32 insertions(+), 9 deletions(-)

[git pull] vfs.git fixes

[Al Viro]

	Backport-friendly part of lock_parent() race fix, a fix for assumption
in the heurisic used by path_connected() that is not true on NFS and livelock
fixes for d_alloc_parallel().

The following changes since commit 91ab883eb21325ad80f3473633f794c78ac87f51:

  Linux 4.16-rc2 (2018-02-18 17:29:42 -0800)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git for-linus

for you to fetch changes up to 95dd77580ccd66a0da96e6d4696945b8cea39431:

  fs: Teach path_connected to handle nfs filesystems with multiple roots. (2018-03-15 18:48:38 -0400)

----------------------------------------------------------------
Al Viro (1):
      lock_parent() needs to recheck if dentry got __dentry_kill'ed under it

Eric W. Biederman (1):
      fs: Teach path_connected to handle nfs filesystems with multiple roots.

Will Deacon (2):
      fs: dcache: Avoid livelock between d_alloc_parallel and __d_add
      fs: dcache: Use READ_ONCE when accessing i_dir_seq

 fs/dcache.c        | 21 ++++++++++++++++-----
 fs/namei.c         |  5 +++--
 fs/nfs/super.c     |  2 ++
 include/linux/fs.h |  1 +
 4 files changed, 22 insertions(+), 7 deletions(-)

[git pull] vfs.git fixes

[Al Viro]

	MS_I_VERSION fixes - Mimi's fix + missing bits picked from
Matthew (his patch contained a duplicate of the fs/namespace.c fix
as well, but by that point the original fix had already been applied)

The following changes since commit 1cfd0ddd82232804e03f3023f6a58b50dfef0574:

  bio_copy_user_iov(): don't ignore ->iov_offset (2017-10-10 23:55:14 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git for-linus

for you to fetch changes up to 357fdad075abb976ee43f2dd450c40dcef4b7e2d:

  Convert fs/*/* to SB_I_VERSION (2017-10-18 18:51:27 -0400)

----------------------------------------------------------------
Matthew Garrett (1):
      Convert fs/*/* to SB_I_VERSION

Mimi Zohar (1):
      vfs: fix mounting a filesystem with i_version

 fs/btrfs/super.c   | 2 +-
 fs/ext4/super.c    | 4 ++--
 fs/fuse/inode.c    | 2 +-
 fs/namespace.c     | 3 ++-
 fs/xfs/xfs_super.c | 2 +-
 5 files changed, 7 insertions(+), 6 deletions(-)

Re: [git pull] vfs.git fixes

[Vitaly Mayatskikh]

On Wed, 11 Oct 2017 00:54:57 -0400,
Al Viro wrote:
> 
> 	Fairly old DIO bug caught by Andreas (3.10+) and several slightly
> younger blk_rq_map_user_iov() bugs, both on map and copy codepaths (Vitaly
> and me).

I ran work.iov_iter changeset through our smoke test few days ago - no apparent smoke.

-- 
wbr, Vitaly

[git pull] vfs.git fixes

[Al Viro]

	Fairly old DIO bug caught by Andreas (3.10+) and several slightly
younger blk_rq_map_user_iov() bugs, both on map and copy codepaths (Vitaly
and me).

The following changes since commit 8a5776a5f49812d29fe4b2d0a2d71675c3facf3f:

  Linux 4.14-rc4 (2017-10-08 20:53:29 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git for-linus

for you to fetch changes up to 1cfd0ddd82232804e03f3023f6a58b50dfef0574:

  bio_copy_user_iov(): don't ignore ->iov_offset (2017-10-10 23:55:14 -0400)

----------------------------------------------------------------
Al Viro (2):
      more bio_map_user_iov() leak fixes
      bio_copy_user_iov(): don't ignore ->iov_offset

Andreas Gruenbacher (1):
      direct-io: Prevent NULL pointer access in submit_page_section

Vitaly Mayatskikh (1):
      fix unbalanced page refcounting in bio_map_user_iov

 block/bio.c    | 26 +++++++++++++++++++-------
 fs/direct-io.c |  3 ++-
 2 files changed, 21 insertions(+), 8 deletions(-)

[git pull] vfs.git fixes

[Al Viro]

	* fix orangefs handling of faults on write() - I'd missed that one
back when orangefs was going through review.
	* readdir counterpart of "9p: cope with bogus responses from server
in p9_client_{read,write}" - server might be lying or broken, and we'd better
not overrun the kmalloc'ed buffer we are copying the results into.
	* NFS O_DIRECT read/write can leave iov_iter advanced by too much;
that's what had been causing iov_iter_pipe() warnings davej had been seeing.
	* statx_timestamp.tv_nsec type fix (s32 -> u32).  That one really
should go in before 4.11.

The following changes since commit 4f7d029b9bf009fbee76bb10c0c4351a1870d2f3:

  Linux 4.11-rc7 (2017-04-16 13:00:18 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git for-linus

for you to fetch changes up to 1741937d475d91ed95abb37f07e8571e23b9a7fe:

  uapi: change the type of struct statx_timestamp.tv_nsec to unsigned (2017-04-26 21:19:05 -0400)

----------------------------------------------------------------
Al Viro (3):
      orangefs_bufmap_copy_from_iovec(): fix EFAULT handling
      p9_client_readdir() fix
      fix nfs O_DIRECT advancing iov_iter too much

Dmitry V. Levin (1):
      uapi: change the type of struct statx_timestamp.tv_nsec to unsigned

 fs/nfs/direct.c               | 27 ++++++++++++++++++---------
 fs/orangefs/orangefs-bufmap.c |  4 +---
 include/uapi/linux/stat.h     |  8 ++------
 net/9p/client.c               |  4 ++++
 4 files changed, 25 insertions(+), 18 deletions(-)

[git pull] vfs.git fixes

[Al Viro]

The following changes since commit a99cde438de0c4c0cecc1d1af1a55a75b10bfdef:

  Linux 4.7-rc6 (2016-07-03 23:01:00 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git for-linus

for you to fetch changes up to 6d4e56ce977864b0fcd28c61555060e6010aa89b:

  posix_acl: de-union a_refcount and a_rcu (2016-07-11 13:48:02 -0400)

----------------------------------------------------------------
Al Viro (2):
      Use the right predicate in ->atomic_open() instances
      nfs_atomic_open(): prevent parallel nfs_lookup() on a negative hashed

Jeff Layton (1):
      posix_acl: de-union a_refcount and a_rcu

 fs/9p/vfs_inode.c         |  2 +-
 fs/9p/vfs_inode_dotl.c    |  2 +-
 fs/ceph/file.c            |  2 +-
 fs/cifs/dir.c             |  2 +-
 fs/fuse/dir.c             |  2 +-
 fs/gfs2/inode.c           |  2 +-
 fs/nfs/dir.c              | 30 ++++++++++++++++++++++++++----
 include/linux/posix_acl.h |  6 ++----
 8 files changed, 34 insertions(+), 14 deletions(-)

[git pull] vfs.git fixes

[Al Viro]

	Tmpfs readdir throughput regression fix (this cycle) + some -stable
fodder all over the place.  One missing bit is Miklos' tonight locks.c fix -
NFS folks had already grabbed that one by the time I woke up ;-)

The following changes since commit e7d6ef9790bc281f5c29d0132b68031248523fe8:

  fix idiotic braino in d_alloc_parallel() (2016-06-20 10:07:42 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git for-linus

for you to fetch changes up to e06b933e6ded42384164d28a2060b7f89243b895:

  namespace: update event counter when umounting a deleted dentry (2016-06-30 23:28:30 -0400)

----------------------------------------------------------------
Al Viro (4):
      dcache_{readdir,dir_lseek}(): don't bother with nested ->d_lock
      libfs.c: new helper - next_positive()
      lockless next_positive()
      ceph: fix d_obtain_alias() misuses

Andrey Ulanov (1):
      namespace: update event counter when umounting a deleted dentry

Miklos Szeredi (1):
      9p: use file_dentry()

 fs/9p/vfs_file.c |   6 +--
 fs/ceph/export.c |  10 ++---
 fs/libfs.c       | 109 ++++++++++++++++++++++++++++++++++++-------------------
 fs/namespace.c   |   1 +
 4 files changed, 78 insertions(+), 48 deletions(-)

[git pull] vfs.git fixes

[Al Viro]

	A couple of fixes (-stable fodder) + dead code removal after the
overlayfs fix; I agree that it's better to separate from the fix part
to make backporting easier, but IMO it's not worth delaying said dead
code removal until the next window.  Please, pull from

git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git for-linus

Shortlog:
Al Viro (2):
      ovl: get rid of the dead code left from broken (and disabled) optimizations
      Don't reset ->total_link_count on nested calls of vfs_path_lookup()

Miklos Szeredi (1):
      ovl: fix permission checking for setattr

Diffstat:
 fs/namei.c               |  1 -
 fs/overlayfs/copy_up.c   | 23 ++++++-----------------
 fs/overlayfs/inode.c     | 19 ++++++++-----------
 fs/overlayfs/overlayfs.h |  3 +--
 4 files changed, 15 insertions(+), 31 deletions(-)

[git pull] vfs.git fixes

[Al Viro]

	A couple of fixes for sendfile lockups caught by Dmitry + a fix
for ancient sysvfs symlink breakage.  Please, pull from

git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git for-linus

Shortlog:
Al Viro (1):
      fix sysvfs symlinks

Jan Kara (2):
      vfs: Make sendfile(2) killable even better
      vfs: Avoid softlockups with sendfile(2)

Diffstat:
 fs/splice.c     |  8 ++++++++
 fs/sysv/inode.c | 11 ++---------
 2 files changed, 10 insertions(+), 9 deletions(-)

[git pull] vfs.git fixes

[Al Viro]

A couple of fixes - deadlock in CIFS and build breakage in cris serial
driver (resurfaced f_dentry in there).  Please, pull from
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git for-linus

Shortlog:
Al Viro (1):
      fix deadlock in cifs_ioctl_clone()

David Howells (1):
      VFS: Convert file->f_dentry->d_inode to file_inode()

Diffstat:
 arch/cris/arch-v32/drivers/sync_serial.c |  2 +-
 fs/cifs/ioctl.c                          | 21 +++++----------------
 2 files changed, 6 insertions(+), 17 deletions(-)

[git pull] vfs.git fixes

[Al Viro]

	Assorted fixes, most in overlayfs land.  Please, pull from the usual
place -
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git for-linus

Shortlog:
Arnd Bergmann (1):
      isofs: avoid unused function warning

Miklos Szeredi (8):
      ovl: rename filesystem type to "overlay"
      ovl: fix remove/copy-up race
      ovl: fix race in private xattr checks
      ovl: allow filenames with comma
      ovl: use lockless_dereference() for upperdentry
      ovl: pass dentry into ovl_dir_read_merged()
      ovl: update MAINTAINERS
      ovl: ovl_dir_fsync() cleanup

Yan, Zheng (1):
      vfs: fix reference leak in d_prune_aliases()

Diffstat:
 Documentation/filesystems/overlayfs.txt |    2 +-
 MAINTAINERS                             |    7 ++--
 fs/Makefile                             |    2 +-
 fs/dcache.c                             |    1 +
 fs/isofs/inode.c                        |   42 ++++++++++-----------
 fs/overlayfs/Kconfig                    |    2 +-
 fs/overlayfs/Makefile                   |    4 +-
 fs/overlayfs/dir.c                      |   31 ++++++++++------
 fs/overlayfs/inode.c                    |   27 +++++++++-----
 fs/overlayfs/readdir.c                  |   39 ++++++++------------
 fs/overlayfs/super.c                    |   61 +++++++++++++++++++++++++------
 11 files changed, 133 insertions(+), 85 deletions(-)

[git pull] vfs.git fixes

[Al Viro]

	A fix for embarrassing braino in o2net_send_tcp_msg().  -stable
fodder...  Please, pull from the usual place -
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git for-linus

Shortlog:
Al Viro (1):
      fix breakage in o2net_send_tcp_msg()

Diffstat:
 fs/ocfs2/cluster/tcp.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

[git pull] vfs.git fixes

[Al Viro]

Several fixes, mostly for regressions in the last pile.  Howeover,
prepend_path() forgetting to reininitalize dentry/vfsmount is in 3.12
as well and qib_fs had been leaking all along...  Please, pull from
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git for-linus

Shortlog:
Al Viro (2):
      prepend_path() needs to reinitialize dentry/vfsmount/mnt on restarts
      qib_fs: fix (some) dcache abuses

Dan Carpenter (2):
      aio: checking for NULL instead of IS_ERR
      locks: missing unlock on error in generic_add_lease()

Li Zhong (1):
      fix unpaired rcu lock in prepend_path()

Diffstat:
 drivers/infiniband/hw/qib/qib_fs.c |    7 +++++--
 fs/aio.c                           |    4 ++--
 fs/dcache.c                        |   13 ++++++++++---
 fs/locks.c                         |    1 +
 4 files changed, 18 insertions(+), 7 deletions(-)