Merge tag 'vfs-7.2-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner: - netfs: - fix the decision when to disallow write-streaming with fscache in use, handling of asynchronous cache object creation, a double fput in cachefiles, clearing S_KERNEL_FILE without the inode lock held, page extraction bugs in the iov_iter helpers (a potential underflow, a missing allocation failure check, a memory leak, and a folio offset miscalculation), writeback error and ENOMEM handling, DIO write retry for filesystems without a ->prepare_write() method, and the replacement of the wb_lock mutex with a bit lock plus writethrough collection offload so that multiple asynchronous writebacks don't interfere with each other. - Fix the barriering when walking the netfs subrequest list during retries as it was possible to see a subrequest that was just added by the application thread. - iomap: - Change iomap to submit read bios after each extent instead of building them up across extents. The old behavior was considered problematic for a while and now caused an actual erofs bug. - Guard the ioend io_size EOF trim in iomap against underflow when a concurrent truncate moves EOF below the start of the ioend, wrapping io_size to a huge value. - overlayfs - Fix a stale overlayfs comment about the locking order. - Store the linked-in upper dentry instead of the disconnected O_TMPFILE dentry during overlayfs tmpfile copy-up. With a FUSE or virtiofs upper layer ->d_revalidate() would try to look up "/" in the workdir and fail, causing persistent ESTALE errors that broke dpkg and apt. - vfs-bpf: Have the bpf_real_data_inode() kfunc take a struct file instead of a dentry so it is usable from the bprm_check_security, mmap_file, and file_mprotect hooks, and rename it from bpf_real_inode() to make the data-inode semantics explicit. The kfunc landed this cycle so the change is safe. - afs: NULL pointer dereferences in the callback service and in afs_get_tree(), several memory and refcount leaks, missing locking around the dynamic root inode numbers and premature cell exposure through /afs, a netns destruction hang caused by a misplaced increment of net->cells_outstanding, a bulk lookup malfunction caused by the dir_emit() API change, inode (re)initialisation issues, and assorted smaller fixes to error codes, seqlock handling, and debug output. - vfs: Refuse O_TMPFILE creation with an unmapped fsuid or fsgid and add a selftest for it. - vboxsf: Add Jori Koolstra as vboxsf maintainer, taking over from Hans de Goede. - dio: Release the pages attached to a short atomic dio bio; the REQ_ATOMIC size check error path leaked them. - procfs: Only bump the parent directory link count when registering directories in procfs. Registering regular files inflated the count and leaked a link on every create and remove cycle. - minix: Avoid an unsigned overflow in the minix bitmap block count calculation that let crafted images with huge inode or zone counts pass superblock validation and crash the kernel during mount. - cachefiles: Fix a double unlock in the cachefiles nomem_d_alloc error path left over from the start_creating() conversion. - fat: Stop fat from reading directory entries past the 0x00 end-of-directory marker. If the trailing on-disk slots aren't zero-filled the driver surfaced arbitrary garbage as directory entries. - freexvfs: Don't BUG() on unknown typed-extent types in freevxfs, reachable via ioctl(FIBMAP) on a crafted image; fail with an I/O error instead. - orangefs: Keep the readdir entry size 64-bit in orangefs fill_from_part(). Truncating it to __u32 bypassed the bounds check and led to out-of-bounds reads triggerable by the userspace client. - xfs: Fix the error unwind in xfs_open_devices() which released the rt device file twice and left dangling buftarg pointers behind that were freed again when the failed mount was torn down. - exec: Fix an off-by-one in the comment documenting the maximum binfmt rewrite depth in exec_binprm(). The code allows five rewrites, not four; restricting the code would break userspace so the comment is fixed instead. - file handles: Reject detached mounts in capable_wrt_mount(). A detached mount can be dissolved concurrently, leaving a NULL mount namespace that open_by_handle_at() would dereference. * tag 'vfs-7.2-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (57 commits) netfs: Fix barriering when walking subrequest list iomap: submit read bio after each extent fuse: call fuse_send_readpages explicitly from fuse_readahead iomap: consolidate bio submission fhandle: reject detached mounts in capable_wrt_mount() netfs: Fix DIO write retry for filesystems without a ->prepare_write() netfs: Fix folio state after ENOMEM whilst under writeback iteration netfs: Fix writeback error handling netfs: Fix writethrough to use collection offload netfs: Replace wb_lock with a bit lock for asynchronicity netfs: Fix kdoc warning scatterlist: Fix offset in folio calc in extract_xarray_to_sg() iov_iter: Remove unused variable in kunit_iov_iter.c iov_iter: Fix a memory leak in iov_iter_extract_user_pages() iov_iter: Fix missing alloc fail check in iov_iter_extract_bvec_pages() iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE cachefiles: Fix double fput netfs: Fix netfs_create_write_req() to handle async cache object creation netfs: Fix decision whether to disallow write-streaming due to fscache use ...

Linus Torvalds committed 4 months ago

Commit 71dfdfb2 parents 025d0d6 5c6ce0552 files · +592 −178Browse files

Unified · Split

52 files

MAINTAINERS +1 −1
fs/afs/callback.c +7 −10
fs/afs/cell.c +21 −6
fs/afs/cmservice.c +5 −2
fs/afs/dir.c +25 −15
fs/afs/dynroot.c +1 −1
fs/afs/fs_operation.c +1 −1
fs/afs/inode.c +7 −8
fs/afs/internal.h +1 −2
fs/afs/super.c +3 −2
fs/afs/symlink.c +2 −2
fs/afs/vl_list.c +21 −3
fs/afs/volume.c +1 −1
fs/bpf_fs_kfuncs.c +14 −9
fs/cachefiles/namei.c +1 −3
fs/exec.c +1 −1
fs/exfat/iomap.c +1 −4
fs/fat/dir.c +40 −4
fs/fhandle.c +1 −1
fs/freevxfs/vxfs_bmap.c +2 −1
fs/fuse/file.c +3 −11
fs/iomap/bio.c +12 −3
fs/iomap/buffered-io.c +8 −8
fs/iomap/direct-io.c +6 −1
fs/iomap/ioend.c +6 −2
fs/minix/minix.h +1 −1
fs/namei.c +4 −0
fs/netfs/buffered_read.c +1 −1
fs/netfs/buffered_write.c +1 −1
fs/netfs/direct_write.c +7 −11
fs/netfs/internal.h +12 −0
fs/netfs/locking.c +95 −0
fs/netfs/read_retry.c +6 −1
fs/netfs/write_collect.c +10 −0
fs/netfs/write_issue.c +24 −31
fs/netfs/write_retry.c +6 −1
fs/ntfs/aops.c +2 −4
fs/ntfs3/inode.c +1 −4
fs/orangefs/dir.c +4 −3
fs/overlayfs/copy_up.c +10 −2
fs/overlayfs/inode.c +2 −2
fs/proc/generic.c +4 −5
fs/xfs/xfs_aops.c +1 −2
fs/xfs/xfs_super.c +3 −0
include/linux/iomap.h +2 −0
include/linux/netfs.h +10 −3
lib/iov_iter.c +19 −1
lib/scatterlist.c +1 −0
lib/tests/kunit_iov_iter.c +2 −3
tools/testing/selftests/filesystems/.gitignore +1 −0
tools/testing/selftests/filesystems/Makefile +4 −0
tools/testing/selftests/filesystems/idmapped_tmpfile.c +168 −0

MAINTAINERS+1−1

@@ -28725,7 +28725,7 @@ F: include/linux/vbox_utils.h · 28724 unmodified lines
28725	F: include/uapi/linux/vbox*.h	28725	F: include/uapi/linux/vbox*.h
28726		28726
28727	VIRTUAL BOX SHARED FOLDER VFS DRIVER	28727	VIRTUAL BOX SHARED FOLDER VFS DRIVER
28728	M: Hans de Goede <hansg@kernel.org>	28728	M: Jori Koolstra <jkoolstra@xs4all.nl>
28729	L: linux-fsdevel@vger.kernel.org	28729	L: linux-fsdevel@vger.kernel.org
28730	S: Maintained	28730	S: Maintained
28731	F: fs/vboxsf/*	28731	F: fs/vboxsf/*

fs/afs/callback.c+7−10

 {
 	struct afs_volume *volume = NULL;
 	struct rb_node *p;
-	int seq = 1;
-	for (;;) {
+	scoped_seqlock_read(&cell->volume_lock, ss_lock) {
 		/* Unfortunately, rbtree walking doesn't give reliable results
 		 * under just the RCU read lock, so we have to check for
 		 * changes.
 		 */
-		seq++; /* 2 on the 1st/lockless path, otherwise odd */
-		read_seqbegin_or_lock(&cell->volume_lock, &seq);
 		p = rcu_dereference_raw(cell->volumes.rb_node);
 		while (p) {
 			volume = rb_entry(p, struct afs_volume, cell_node);
 		if (volume && afs_try_get_volume(volume, afs_volume_trace_get_callback))
 			break;
-		if (!need_seqretry(&cell->volume_lock, seq))
+		volume = NULL;
-			break;
-		seq |= 1; /* Want a lock next time */
 	}
-	done_seqretry(&cell->volume_lock, seq);
 	return volume;
 }
 	rcu_read_lock();
 	volume = afs_lookup_volume_rcu(server->cell, vid);
-	if (cbb->fid.vnode == 0 && cbb->fid.unique == 0) {
+	if (!volume) {
+		/* Ignore breaks on unknown volumes. */
+		rcu_read_unlock();
+		*_count = 0;
+	} else if (cbb->fid.vnode == 0 && cbb->fid.unique == 0) {
 		afs_break_volume_callback(server, volume);
 		*_count -= 1;
 		if (*_count)

fs/afs/cell.c+21−6

 	cell->dns_status = vllist->status;
 	smp_store_release(&cell->dns_lookup_count, 1); /* vs source/status */
 	atomic_inc(&net->cells_outstanding);
-	ret = idr_alloc_cyclic(&net->cells_dyn_ino, cell,
-			       2, INT_MAX / 2, GFP_KERNEL);
-	if (ret < 0)
-		goto error;
-	cell->dynroot_ino = ret;
 	cell->debug_id = atomic_inc_return(&cell_debug_id);
 	trace_afs_cell(cell->debug_id, 1, 0, afs_cell_trace_alloc);
 			goto cell_already_exists;
 	}
+	ret = idr_alloc_cyclic(&net->cells_dyn_ino, candidate,
+			       2, INT_MAX / 2, GFP_KERNEL);
+	if (ret < 0)
+		goto cant_alloc_ino;
+	candidate->dynroot_ino = ret;
+	set_bit(AFS_CELL_FL_HAVE_INO, &candidate->flags);
 	cell = candidate;
 	candidate = NULL;
 	afs_use_cell(cell, trace);
 	_leave(" = %p [cell]", cell);
 	return cell;
+cant_alloc_ino:
+	up_write(&net->cells_lock);
+	afs_put_cell(candidate, afs_cell_trace_put_candidate);
+	goto error_noput;
 cell_already_exists:
 	_debug("cell exists");
 	cell = cursor;
 		rcu_assign_pointer(cell->vl_servers, vllist);
 		cell->dns_source = vllist->source;
 		old = p;
+	} else {
+		old = vllist;
 	}
 	write_unlock(&cell->vl_servers_lock);
 	afs_put_vlserverlist(cell->net, old);
 	afs_put_vlserverlist(net, rcu_access_pointer(cell->vl_servers));
 	afs_unuse_cell(cell->alias_of, afs_cell_trace_unuse_alias);
 	key_put(cell->anonymous_key);
-	idr_remove(&net->cells_dyn_ino, cell->dynroot_ino);
 	kfree(cell->name - 1);
 	kfree(cell);
 	afs_see_cell(cell, afs_cell_trace_destroy);
 	timer_delete_sync(&cell->management_timer);
 	cancel_work_sync(&cell->manager);
+	if (test_bit(AFS_CELL_FL_HAVE_INO, &cell->flags)) {
+		down_write(&cell->net->cells_lock);
+		idr_remove(&cell->net->cells_dyn_ino, cell->dynroot_ino);
+		up_write(&cell->net->cells_lock);
+	}
 	call_rcu(&cell->rcu, afs_cell_destroy);
 }

fs/afs/cmservice.c+5−2

 		ret = afs_extract_data(call, false);
 		switch (ret) {
 		case 0:		break;
-		case -EAGAIN:	return 0;
 		default:	return ret;
 		}
 	if (!afs_check_call_state(call, AFS_CALL_SV_REPLYING))
 		return afs_io_error(call, afs_io_error_cm_reply);
+	if (!call->server) {
+		trace_afs_cm_no_server_u(call, call->request);
+		return 0;
+	}
 	if (memcmp(call->request, &call->server->_uuid, sizeof(call->server->_uuid)) != 0) {
 		pr_notice("Callback UUID does not match fileserver UUID\n");
 		trace_afs_cm_no_server_u(call, call->request);
 		ret = afs_extract_data(call, false);
 		switch (ret) {
 		case 0:		break;
-		case -EAGAIN:	return 0;
 		default:	return ret;
 		}

fs/afs/dir.c+25−15

 static int afs_d_delete(const struct dentry *dentry);
 static void afs_d_iput(struct dentry *dentry, struct inode *inode);
 static bool afs_lookup_one_filldir(struct dir_context *ctx, const char *name, int nlen,
-				  loff_t fpos, u64 ino, unsigned dtype);
+				   u64 ino, u32 uniquifier);
+#define AFS_LOOKUP_ONE ((filldir_t)0x123UL)
 static bool afs_lookup_filldir(struct dir_context *ctx, const char *name, int nlen,
-			      loff_t fpos, u64 ino, unsigned dtype);
+			       u64 ino, u32 uniquifier);
+#define AFS_LOOKUP ((filldir_t)0x137UL)
 static int afs_create(struct mnt_idmap *idmap, struct inode *dir,
 		      struct dentry *dentry, umode_t mode, bool excl);
 static struct dentry *afs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
 		}
 		/* found the next entry */
-		if (!dir_emit(ctx, dire->u.name, nlen,
+		if (ctx->actor == AFS_LOOKUP) {
-			      ntohl(dire->u.vnode),
+			if (!afs_lookup_filldir(ctx, dire->u.name, nlen,
-			      (ctx->actor == afs_lookup_filldir ||
+						ntohl(dire->u.vnode),
-			       ctx->actor == afs_lookup_one_filldir)?
+						ntohl(dire->u.unique)))
-			      ntohl(dire->u.unique) : DT_UNKNOWN)) {
+				return 0;
+		} else if (ctx->actor == AFS_LOOKUP_ONE) {
+			if (!afs_lookup_one_filldir(ctx, dire->u.name, nlen,
+						    ntohl(dire->u.vnode),
+						    ntohl(dire->u.unique)))
+				return 0;
+		} else if (!dir_emit(ctx, dire->u.name, nlen,
+				     ntohl(dire->u.vnode), DT_UNKNOWN)) {
 			_leave(" = 0 [full]");
 			return 0;
 		}
 {
 	afs_dataversion_t dir_version;
+	ctx->dt_flags_mask = UINT_MAX;
 	return afs_dir_iterate(file_inode(file), ctx, file, &dir_version);
 }
  *   uniquifier through dtype
  */
 static bool afs_lookup_one_filldir(struct dir_context *ctx, const char *name,
-				  int nlen, loff_t fpos, u64 ino, unsigned dtype)
+				  int nlen, u64 ino, u32 uniquifier)
 {
 	struct afs_lookup_one_cookie *cookie =
 		container_of(ctx, struct afs_lookup_one_cookie, ctx);
 	_enter("{%s,%u},%s,%u,,%llu,%u",
 	       cookie->name.name, cookie->name.len, name, nlen,
-	       (unsigned long long) ino, dtype);
+	       (unsigned long long) ino, uniquifier);
 	/* insanity checks first */
 	BUILD_BUG_ON(sizeof(union afs_xdr_dir_block) != 2048);
 	}
 	cookie->fid.vnode = ino;
-	cookie->fid.unique = dtype;
+	cookie->fid.unique = uniquifier;
 	cookie->found = 1;
 	_leave(" = false [found]");
 {
 	struct afs_super_info *as = dir->i_sb->s_fs_info;
 	struct afs_lookup_one_cookie cookie = {
-		.ctx.actor = afs_lookup_one_filldir,
+		.ctx.actor = AFS_LOOKUP_ONE,
 		.name = *name,
 		.fid.vid = as->volume->vid
 	};
  *   uniquifier through dtype
  */
 static bool afs_lookup_filldir(struct dir_context *ctx, const char *name,
-			      int nlen, loff_t fpos, u64 ino, unsigned dtype)
+			      int nlen, u64 ino, u32 uniquifier)
 {
 	struct afs_lookup_cookie *cookie =
 		container_of(ctx, struct afs_lookup_cookie, ctx);
 	_enter("{%s,%u},%s,%u,,%llu,%u",
 	       cookie->name.name, cookie->name.len, name, nlen,
-	       (unsigned long long) ino, dtype);
+	       (unsigned long long) ino, uniquifier);
 	/* insanity checks first */
 	BUILD_BUG_ON(sizeof(union afs_xdr_dir_block) != 2048);
 	if (cookie->nr_fids < 50) {
 		cookie->fids[cookie->nr_fids].vnode	= ino;
-		cookie->fids[cookie->nr_fids].unique	= dtype;
+		cookie->fids[cookie->nr_fids].unique	= uniquifier;
 		cookie->nr_fids++;
 	}
 	for (i = 0; i < ARRAY_SIZE(cookie->fids); i++)
 		cookie->fids[i].vid = dvnode->fid.vid;
-	cookie->ctx.actor = afs_lookup_filldir;
+	cookie->ctx.actor = AFS_LOOKUP;
 	cookie->name = dentry->d_name;
 	cookie->nr_fids = 2; /* slot 1 is saved for the fid we actually want
 			      * and slot 0 for the directory */

fs/afs/dynroot.c+1−1

@@ -278,7 +278,7 @@ static struct dentry afs_lookup_atcell(struct inode dir, struct dentry *dentry · 277 unmodified lines
278	}	278	}
279		279
280	/*	280	/*
281	* Transcribe the cell database into readdir content under the RCU read lock.	281	* Transcribe the cell database into readdir content under net->cells_lock.
282	* Each cell produces two entries, one prefixed with a dot and one not.	282	* Each cell produces two entries, one prefixed with a dot and one not.
283	*/	283	*/
284	static int afs_dynroot_readdir_cells(struct afs_net net, struct dir_context ctx)	284	static int afs_dynroot_readdir_cells(struct afs_net net, struct dir_context ctx)

fs/afs/fs_operation.c+1−1

@@ -348,7 +348,7 @@ int afs_put_operation(struct afs_operation *op) · 347 unmodified lines
348	for (i = 0; i < op->nr_files - 2; i++)	348	for (i = 0; i < op->nr_files - 2; i++)
349	if (op->more_files[i].put_vnode)	349	if (op->more_files[i].put_vnode)
350	iput(&op->more_files[i].vnode->netfs.inode);	350	iput(&op->more_files[i].vnode->netfs.inode);
351	kfree(op->more_files);	351	kvfree(op->more_files);
352	}	352	}
353		353
354	if (op->estate) {	354	if (op->estate) {

fs/afs/inode.c+7−8

 /*
  * Set parameters for the netfs library
  */
-static void afs_set_netfs_context(struct afs_vnode *vnode)
+static void afs_set_netfs_context(struct afs_vnode *vnode, bool is_file)
 {
-	netfs_inode_init(&vnode->netfs, &afs_req_ops, true);
+	netfs_inode_init(&vnode->netfs, &afs_req_ops, is_file);
 }
 /*
 	inode->i_gid = make_kgid(&init_user_ns, status->group);
 	set_nlink(&vnode->netfs.inode, status->nlink);
+	i_size_write(inode, status->size);
+	inode_set_bytes(inode, status->size);
+	afs_set_netfs_context(vnode, status->type == AFS_FTYPE_FILE);
 	switch (status->type) {
 	case AFS_FTYPE_FILE:
 		inode->i_mode	= S_IFREG | (status->mode & S_IALLUGO);
 		}
 		inode->i_mapping->a_ops	= &afs_symlink_aops;
 		inode_nohighmem(inode);
-		mapping_set_release_always(inode->i_mapping);
 		break;
 	default:
 		dump_vnode(vnode, op->file[0].vnode != vnode ? op->file[0].vnode : NULL);
 		return afs_protocol_error(NULL, afs_eproto_file_type);
 	}
-	i_size_write(inode, status->size);
-	inode_set_bytes(inode, status->size);
-	afs_set_netfs_context(vnode);
 	vnode->invalid_before	= status->data_version;
 	trace_afs_set_dv(vnode, status->data_version);
 	inode_set_iversion_raw(&vnode->netfs.inode, status->data_version);
 	vnode = AFS_FS_I(inode);
 	vnode->cb_v_check = atomic_read(&as->volume->cb_v_break);
-	afs_set_netfs_context(vnode);
 	op = afs_alloc_operation(key, as->volume);
 	if (IS_ERR(op)) {
 		inode->i_mapping->a_ops->writepages(inode->i_mapping, &wbc);
 	}
+	flush_delayed_work(&vnode->lock_work);
 	netfs_wait_for_outstanding_io(inode);
 	truncate_inode_pages_final(&inode->i_data);
 	netfs_free_folioq_buffer(vnode->directory);

fs/afs/internal.h+1−2

 #define AFS_CELL_FL_NO_GC	0		/* The cell was added manually, don't auto-gc */
 #define AFS_CELL_FL_DO_LOOKUP	1		/* DNS lookup requested */
 #define AFS_CELL_FL_CHECK_ALIAS	2		/* Need to check for aliases */
+#define AFS_CELL_FL_HAVE_INO	3		/* Have dynroot_ino */
 	enum afs_cell_state	state;
 	short			error;
 	enum dns_record_source	dns_source:8;	/* Latest source of data from lookup */
 {
 #ifdef CONFIG_AFS_FSCACHE
 	vnode->netfs.cache = cookie;
-	if (cookie)
-		mapping_set_release_always(vnode->netfs.inode.i_mapping);
 #endif
 }

fs/afs/super.c+3−2

 	}
 	fc->root = dget(sb->s_root);
-	trace_afs_get_tree(as->cell, as->volume);
+	if (!ctx->dyn_root)
+		trace_afs_get_tree(as->cell, as->volume);
 	_leave(" = 0 [%p]", sb);
 	return 0;
 	INIT_LIST_HEAD(&vnode->wb_keys);
 	INIT_LIST_HEAD(&vnode->pending_locks);
 	INIT_LIST_HEAD(&vnode->granted_locks);
-	INIT_DELAYED_WORK(&vnode->lock_work, afs_lock_work);
 	INIT_LIST_HEAD(&vnode->cb_mmap_link);
 	seqlock_init(&vnode->cb_lock);
 }
 	init_rwsem(&vnode->rmdir_lock);
 	INIT_WORK(&vnode->cb_work, afs_invalidate_mmap_work);
+	INIT_DELAYED_WORK(&vnode->lock_work, afs_lock_work);
 	_leave(" = %p", &vnode->netfs.inode);
 	return &vnode->netfs.inode;

fs/afs/symlink.c+2−2

@@ -255,11 +255,11 @@ int afs_symlink_writepages(struct address_space *mapping, · 254 unmodified lines
255	}	255	}
256		256
257	if (ret == 0) {	257	if (ret == 0) {
258	mutex_lock(&vnode->netfs.wb_lock);	258	netfs_wb_begin(&vnode->netfs, false);
259	netfs_free_folioq_buffer(vnode->directory);	259	netfs_free_folioq_buffer(vnode->directory);
260	vnode->directory = NULL;	260	vnode->directory = NULL;
261	vnode->directory_size = 0;	261	vnode->directory_size = 0;
262	mutex_unlock(&vnode->netfs.wb_lock);	262	netfs_wb_end(&vnode->netfs);
263	} else if (ret == 1) {	263	} else if (ret == 1) {
264	ret = 0; /* Skipped write due to lock conflict. */	264	ret = 0; /* Skipped write due to lock conflict. */
265	}	265	}

fs/afs/vl_list.c+21−3

 {
 	struct afs_addr_list *alist;
 	const u8 *b = *_b;
-	int ret = -EINVAL;
+	int ret;
 	alist = afs_alloc_addrlist(nr_addrs);
 	if (!alist)
 		case DNS_ADDRESS_IS_IPV4:
 			if (end - b < 4) {
 				_leave(" = -EINVAL [short inet]");
+				ret = -EINVAL;
 				goto error;
 			}
 			memcpy(x, b, 4);
 		case DNS_ADDRESS_IS_IPV6:
 			if (end - b < 16) {
 				_leave(" = -EINVAL [short inet6]");
+				ret = -EINVAL;
 				goto error;
 			}
 			memcpy(x, b, 16);
 	b += sizeof(*hdr);
 	while (end - b >= sizeof(bs)) {
+		int nlen;
 		bs.name_len	= afs_extract_le16(&b);
 		bs.priority	= afs_extract_le16(&b);
 		bs.weight	= afs_extract_le16(&b);
 		bs.protocol	= *b++;
 		bs.nr_addrs	= *b++;
+		nlen = min3(bs.name_len, end - b, 255);
 		_debug("extract %u %u %u %u %u %u %*.*s",
 		       bs.name_len, bs.priority, bs.weight,
 		       bs.port, bs.protocol, bs.nr_addrs,
-		       bs.name_len, bs.name_len, b);
+		       bs.name_len, nlen, b);
 		if (end - b < bs.name_len)
 			break;
 			afs_put_addrlist(old, afs_alist_trace_put_vlserver_old);
 		}
+		/* Check for duplicates in the server list */
+		for (j = 0; j < vllist->nr_servers; j++) {
+			struct afs_vlserver *s = vllist->servers[j].server;
-		/* TODO: Might want to check for duplicates */
+			if (s->name_len == server->name_len &&
+			    s->port == server->port &&
+			    strncasecmp(s->name, server->name, server->name_len) == 0) {
+				afs_put_vlserver(cell->net, server);
+				server = NULL;
+				break;
+			}
+		}
+		if (!server)
+			continue;
 		/* Insertion-sort by priority and weight */
 		for (j = 0; j < vllist->nr_servers; j++) {

fs/afs/volume.c+1−1

@@ -40,7 +40,7 @@ static struct afs_volume afs_insert_volume_into_cell(struct afs_cell cell, · 39 unmodified lines
40	goto found;	40	goto found;
41	}	41	}
42		42
43	set_bit(AFS_VOLUME_RM_TREE, &volume->flags);	43	set_bit(AFS_VOLUME_RM_TREE, &p->flags);
44	rb_replace_node_rcu(&p->cell_node, &volume->cell_node, &cell->volumes);	44	rb_replace_node_rcu(&p->cell_node, &volume->cell_node, &cell->volumes);
45	}	45	}
46	}	46	}

fs/bpf_fs_kfuncs.c+14−9

 #endif /* CONFIG_CGROUPS */
 /**
- * bpf_real_inode - get the real inode backing a dentry
+ * bpf_real_data_inode - get the real inode hosting a file's data
- * @dentry: dentry to resolve
+ * @file: file to resolve
  *
- * If the dentry is on a union/overlay filesystem, return the underlying, real
+ * Resolve @file to the inode that hosts its data. For a regular file on a
- * inode that hosts the data.  Otherwise return the inode attached to the
+ * union/overlay filesystem this is the underlying (upper or lower) inode that
- * dentry itself.
+ * stores the data, not the overlay inode.
  *
- * Return: The real inode backing the dentry, or NULL for a negative dentry.
+ * Data resolution only applies to regular files. For a non-regular file (e.g.
+ * a device node, fifo or socket) on a union/overlay filesystem the overlay
+ * inode itself is returned; for any file on a non-union filesystem the inode
+ * attached to @file is returned.
+ *
+ * Return: The inode hosting @file's data, or NULL.
  */
-__bpf_kfunc struct inode *bpf_real_inode(struct dentry *dentry)
+__bpf_kfunc struct inode *bpf_real_data_inode(struct file *file)
 {
-	return d_real_inode(dentry);
+	return d_real_inode(file_dentry(file));
 }
 __bpf_kfunc_end_defs();
 BTF_ID_FLAGS(func, bpf_get_file_xattr, KF_SLEEPABLE)
 BTF_ID_FLAGS(func, bpf_set_dentry_xattr, KF_SLEEPABLE)
 BTF_ID_FLAGS(func, bpf_remove_dentry_xattr, KF_SLEEPABLE)
-BTF_ID_FLAGS(func, bpf_real_inode, KF_SLEEPABLE | KF_RET_NULL)
+BTF_ID_FLAGS(func, bpf_real_data_inode, KF_SLEEPABLE | KF_RET_NULL)
 BTF_KFUNCS_END(bpf_fs_kfunc_set_ids)
 static int bpf_fs_kfuncs_filter(const struct bpf_prog *prog, u32 kfunc_id)

fs/cachefiles/namei.c+1−3

 	return ERR_PTR(ret);
 nomem_d_alloc:
-	inode_unlock(d_inode(dir));
 	_leave(" = -ENOMEM");
 	return ERR_PTR(-ENOMEM);
 }
 					    "Rename failed with error %d", ret);
 	}
-	__cachefiles_unmark_inode_in_use(object, d_inode(rep));
+	cachefiles_do_unmark_inode_in_use(object, d_inode(rep));
 	end_renaming(&rd);
 	_leave(" = 0");
 	return 0;
 	ret = -EINVAL;
 	if (unlikely(!file->f_op->read_iter) ||
 	    unlikely(!file->f_op->write_iter)) {
-		fput(file);
 		pr_notice("Cache does not support read_iter and write_iter\n");
 		goto err_unuse;
 	}

fs/exec.c+1−1

@@ -1717,7 +1717,7 @@ static int exec_binprm(struct linux_binprm *bprm) · 1716 unmodified lines
1717	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));	1717	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
1718	rcu_read_unlock();	1718	rcu_read_unlock();
1719		1719
1720	/* This allows 4 levels of binfmt rewrites before failing hard. */	1720	/* This allows 5 levels of binfmt rewrites before failing hard. */
1721	for (depth = 0;; depth++) {	1721	for (depth = 0;; depth++) {
1722	struct file *exec;	1722	struct file *exec;
1723	if (depth > 5)	1723	if (depth > 5)

fs/exfat/iomap.c+1−4

 static void exfat_iomap_bio_submit_read(const struct iomap_iter *iter,
 		struct iomap_read_folio_ctx *ctx)
 {
-	struct bio *bio = ctx->read_ctx;
+	iomap_bio_submit_read_endio(iter, ctx, exfat_iomap_read_end_io);
-	bio->bi_end_io = exfat_iomap_read_end_io;
-	submit_bio(bio);
 }
 const struct iomap_read_ops exfat_iomap_bio_read_ops = {

fs/fat/dir.c+40−4

 	return fat__get_entry(dir, pos, bh, de);
 }
+/*
+ * Like fat_get_entry(), but honour the FAT end-of-directory marker:
+ * a dirent whose first name byte is NUL terminates iteration per the
+ * spec, which also guarantees that every following slot is zeroed.
+ * Skip straight to the end of the directory so the next call returns
+ * -1 from fat_bmap() without re-reading the trailing zero slots, and
+ * so callers that persist *pos across invocations (e.g. readdir's
+ * ctx->pos) keep reporting EOD.  Release *bh and set it to NULL to
+ * match fat_get_entry()'s contract that *bh is NULL on the -1 return.
+ */
+static int fat_get_entry_eod(struct inode *dir, loff_t *pos,
+			     struct buffer_head **bh,
+			     struct msdos_dir_entry **de)
+{
+	int err = fat_get_entry(dir, pos, bh, de);
+	if (err == 0 && (*de)->name[0] == 0) {
+		brelse(*bh);
+		*bh = NULL;
+		*pos = dir->i_size;
+		return -1;
+	}
+	return err;
+}
 /*
  * Convert Unicode 16 to UTF-8, translated Unicode, or ASCII.
  * If uni_xlate is enabled and we can't get a 1:1 conversion, use a
 		if (ds->id & 0x40)
 			(*unicode)[offset + 13] = 0;
-		if (fat_get_entry(dir, pos, bh, de) < 0)
+		if (fat_get_entry_eod(dir, pos, bh, de) < 0)
 			return PARSE_EOF;
 		if (slot == 0)
 			break;
 	err = -ENOENT;
 	while (1) {
-		if (fat_get_entry(inode, &cpos, &bh, &de) == -1)
+		if (fat_get_entry_eod(inode, &cpos, &bh, &de) == -1)
 			goto end_of_dir;
 parse_record:
 		nr_slots = 0;
 	bh = NULL;
 get_new:
-	if (fat_get_entry(inode, &cpos, &bh, &de) == -1)
+	if (fat_get_entry_eod(inode, &cpos, &bh, &de) == -1)
 		goto end_of_dir;
 parse_record:
 	nr_slots = 0;
 			       struct buffer_head **bh,
 			       struct msdos_dir_entry **de)
 {
-	while (fat_get_entry(dir, pos, bh, de) >= 0) {
+	while (fat_get_entry_eod(dir, pos, bh, de) >= 0) {
 		/* free entry or long name entry or volume label */
 		if (!IS_FREE((*de)->name) && !((*de)->attr & ATTR_VOLUME))
 			return 0;
 	struct msdos_dir_entry *de;
 	int err, free_slots, i, nr_bhs;
 	loff_t pos;
+	bool saw_eod;
 	sinfo->nr_slots = nr_slots;
 	bh = prev = NULL;
 	pos = 0;
 	err = -ENOSPC;
+	saw_eod = false;
 	while (fat_get_entry(dir, &pos, &bh, &de) > -1) {
 		/* check the maximum size of directory */
 		if (pos >= FAT_MAX_DIR_SIZE)
 			goto error;
 		if (IS_FREE(de->name)) {
+			if (de->name[0] == 0)
+				saw_eod = true;
 			if (prev != bh) {
 				get_bh(bh);
 				bhs[nr_bhs] = prev = bh;
 			if (free_slots == nr_slots)
 				goto found;
 		} else {
+			if (saw_eod) {
+				fat_fs_error_ratelimit(sb,
+					"allocated dir entry found after end-of-directory marker (i_pos %lld)",
+					MSDOS_I(dir)->i_pos);
+				err = -EIO;
+				goto error;
+			}
 			for (i = 0; i < nr_bhs; i++)
 				brelse(bhs[i]);
 			prev = NULL;

fs/fhandle.c+1−1

@@ -295,7 +295,7 @@ static bool capable_wrt_mount(struct mount *mount) · 294 unmodified lines
295	*/	295	*/
296	guard(rcu)();	296	guard(rcu)();
297	mnt_ns = READ_ONCE(mount->mnt_ns);	297	mnt_ns = READ_ONCE(mount->mnt_ns);
298	return ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN);	298	return mnt_ns && ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN);
299	}	299	}
300		300
301	static inline int may_decode_fh(struct handle_to_path_ctx *ctx,	301	static inline int may_decode_fh(struct handle_to_path_ctx *ctx,

fs/freevxfs/vxfs_bmap.c+2−1

@@ -227,7 +227,8 @@ vxfs_bmap_typed(struct inode *ip, long iblock) · 226 unmodified lines
227	return 0;	227	return 0;
228	}	228	}
229	default:	229	default:
230	BUG();	230	WARN_ON_ONCE(1);
		231	return 0;
231	}	232	}
232	}	233	}
233		234

fs/fuse/file.c+3−11

 	return ret;
 }
-static void fuse_iomap_submit_read(const struct iomap_iter *iter,
-		struct iomap_read_folio_ctx *ctx)
-{
-	struct fuse_fill_read_data *data = ctx->read_ctx;
-	if (data->ia)
-		fuse_send_readpages(data->ia, data->file, data->nr_bytes,
-				    data->fc->async_read);
-}
 static const struct iomap_read_ops fuse_iomap_read_ops = {
 	.read_folio_range = fuse_iomap_read_folio_range_async,
-	.submit_read = fuse_iomap_submit_read,
 };
 static int fuse_read_folio(struct file *file, struct folio *folio)
 		return;
 	iomap_readahead(&fuse_iomap_ops, &ctx, NULL);
+	if (data.ia)
+		fuse_send_readpages(data.ia, data.file, data.nr_bytes,
+				    fc->async_read);
 }
 static ssize_t fuse_cache_read_iter(struct kiocb *iocb, struct iov_iter *to)

fs/iomap/bio.c+12−3

 	return __iomap_read_end_io(&ioend->io_bio, ioend->io_error);
 }
-static void iomap_bio_submit_read(const struct iomap_iter *iter,
+void iomap_bio_submit_read_endio(const struct iomap_iter *iter,
-		struct iomap_read_folio_ctx *ctx)
+		struct iomap_read_folio_ctx *ctx, bio_end_io_t end_io)
 {
 	struct bio *bio = ctx->read_ctx;
+	bio->bi_end_io = end_io;
 	if (iter->iomap.flags & IOMAP_F_INTEGRITY)
 		fs_bio_integrity_alloc(bio);
 	submit_bio(bio);
+	ctx->read_ctx = NULL;
+}
+EXPORT_SYMBOL_GPL(iomap_bio_submit_read_endio);
+static void iomap_bio_submit_read(const struct iomap_iter *iter,
+		struct iomap_read_folio_ctx *ctx)
+{
+	return iomap_bio_submit_read_endio(iter, ctx, iomap_read_end_io);
 }
 static struct bio_set *iomap_read_bio_set(struct iomap_read_folio_ctx *ctx)
 	if (ctx->rac)
 		bio->bi_opf |= REQ_RAHEAD;
 	bio->bi_iter.bi_sector = iomap_sector(iomap, iter->pos);
-	bio->bi_end_io = iomap_read_end_io;
 	bio_add_folio_nofail(bio, folio, plen,
 			offset_in_folio(folio, iter->pos));
 	ctx->read_ctx = bio;

fs/iomap/buffered-io.c+8−8

@@ -642,12 +642,12 @@ void iomap_read_folio(const struct iomap_ops *ops, · 641 unmodified lines
642	fsverity_readahead(ctx->vi, folio->index,	642	fsverity_readahead(ctx->vi, folio->index,
643	folio_nr_pages(folio));	643	folio_nr_pages(folio));
644		644
645	while ((ret = iomap_iter(&iter, ops)) > 0)	645	while ((ret = iomap_iter(&iter, ops)) > 0) {
646	iter.status = iomap_read_folio_iter(&iter, ctx,	646	iter.status = iomap_read_folio_iter(&iter, ctx,
647	&bytes_submitted);	647	&bytes_submitted);
648		648	if (ctx->read_ctx && ctx->ops->submit_read)
649	if (ctx->read_ctx && ctx->ops->submit_read)	649	ctx->ops->submit_read(&iter, ctx);
650	ctx->ops->submit_read(&iter, ctx);	650	}
651		651
652	if (ctx->cur_folio)	652	if (ctx->cur_folio)
653	iomap_read_end(ctx->cur_folio, bytes_submitted);	653	iomap_read_end(ctx->cur_folio, bytes_submitted);
@@ -718,12 +718,12 @@ void iomap_readahead(const struct iomap_ops *ops, · 64 unmodified lines
718	fsverity_readahead(ctx->vi, readahead_index(rac),	718	fsverity_readahead(ctx->vi, readahead_index(rac),
719	readahead_count(rac));	719	readahead_count(rac));
720		720
721	while (iomap_iter(&iter, ops) > 0)	721	while (iomap_iter(&iter, ops) > 0) {
722	iter.status = iomap_readahead_iter(&iter, ctx,	722	iter.status = iomap_readahead_iter(&iter, ctx,
723	&cur_bytes_submitted);	723	&cur_bytes_submitted);
724		724	if (ctx->read_ctx && ctx->ops->submit_read)
725	if (ctx->read_ctx && ctx->ops->submit_read)	725	ctx->ops->submit_read(&iter, ctx);
726	ctx->ops->submit_read(&iter, ctx);	726	}
727		727
728	if (ctx->cur_folio)	728	if (ctx->cur_folio)
729	iomap_read_end(ctx->cur_folio, cur_bytes_submitted);	729	iomap_read_end(ctx->cur_folio, cur_bytes_submitted);

fs/iomap/direct-io.c+6−1

 	 */
 	if ((op & REQ_ATOMIC) && WARN_ON_ONCE(ret != iomap_length(iter))) {
 		ret = -EINVAL;
-		goto out_put_bio;
+		goto out_bio_release_pages;
 	}
 	if (iter->iomap.flags & IOMAP_F_INTEGRITY) {
 	iomap_dio_submit_bio(iter, dio, bio, pos);
 	return ret;
+out_bio_release_pages:
+	if (dio->flags & IOMAP_DIO_BOUNCE)
+		bio_iov_iter_unbounce(bio, true, false);
+	else
+		bio_release_pages(bio, false);
 out_put_bio:
 	bio_put(bio);
 	return ret;

fs/iomap/ioend.c+6−2

 	 * appending writes.
 	 */
 	ioend->io_size += map_len;
-	if (ioend->io_offset + ioend->io_size > end_pos)
+	if (ioend->io_offset + ioend->io_size > end_pos) {
-		ioend->io_size = end_pos - ioend->io_offset;
+		if (ioend->io_offset >= end_pos)
+			ioend->io_size = 0;
+		else
+			ioend->io_size = end_pos - ioend->io_offset;
+	}
 	wbc_account_cgroup_owner(wpc->wbc, folio, map_len);
 	return map_len;

fs/minix/minix.h+1−1

@@ -97,7 +97,7 @@ static inline struct minix_inode_info minix_i(struct inode inode) · 96 unmodified lines
97		97
98	static inline unsigned minix_blocks_needed(unsigned bits, unsigned blocksize)	98	static inline unsigned minix_blocks_needed(unsigned bits, unsigned blocksize)
99	{	99	{
100	return DIV_ROUND_UP(bits, blocksize * 8);	100	return DIV_ROUND_UP_POW2(bits, blocksize * 8);
101	}	101	}
102		102
103	#if defined(CONFIG_MINIX_FS_NATIVE_ENDIAN) && \	103	#if defined(CONFIG_MINIX_FS_NATIVE_ENDIAN) && \

fs/namei.c+4−0

 	int error;
 	int open_flag = file->f_flags;
+	/* A tmpfile is I_LINKABLE, so guard its owner like may_o_create(). */
+	if (!fsuidgid_has_mapping(dir->i_sb, idmap))
+		return -EOVERFLOW;
 	/* we want directory to be writable */
 	error = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC);
 	if (error)

fs/netfs/buffered_read.c+1−1

@@ -659,7 +659,7 @@ retry: · 658 unmodified lines
659	* within the cache granule containing the EOF, in which case we need	659	* within the cache granule containing the EOF, in which case we need
660	* to preload the granule.	660	* to preload the granule.
661	*/	661	*/
662	if (!netfs_is_cache_enabled(ctx) &&	662	if (!netfs_is_cache_maybe_enabled(ctx) &&
663	netfs_skip_folio_read(folio, pos, len, false)) {	663	netfs_skip_folio_read(folio, pos, len, false)) {
664	netfs_stat(&netfs_n_rh_write_zskip);	664	netfs_stat(&netfs_n_rh_write_zskip);
665	goto have_folio_no_wait;	665	goto have_folio_no_wait;

fs/netfs/buffered_write.c+1−1

@@ -277,7 +277,7 @@ ssize_t netfs_perform_write(struct kiocb iocb, struct iov_iter iter, · 276 unmodified lines
277	* caching service temporarily because the backing store got	277	* caching service temporarily because the backing store got
278	* culled.	278	* culled.
279	*/	279	*/
280	if (netfs_is_cache_enabled(ctx)) {	280	if (netfs_is_cache_maybe_enabled(ctx)) {
281	if (finfo) {	281	if (finfo) {
282	netfs_stat(&netfs_n_wh_wstream_conflict);	282	netfs_stat(&netfs_n_wh_wstream_conflict);
283	goto flush_content;	283	goto flush_content;

fs/netfs/direct_write.c+7−11

 		 */
 		subreq->error = -EAGAIN;
 		trace_netfs_sreq(subreq, netfs_sreq_trace_retry);
-		if (subreq->transferred > 0)
+		if (subreq->transferred > 0) {
 			iov_iter_advance(&wreq->buffer.iter, subreq->transferred);
+			wreq->transferred += subreq->transferred;
+		}
 		if (stream->source == NETFS_UPLOAD_TO_SERVER &&
 		    wreq->netfs_ops->retry_request)
 			wreq->netfs_ops->retry_request(wreq, stream);
+		__clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags);
 		__clear_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags);
 		__clear_bit(NETFS_SREQ_BOUNDARY, &subreq->flags);
 		__clear_bit(NETFS_SREQ_FAILED, &subreq->flags);
 		netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit);
-		if (stream->prepare_write) {
+		if (stream->prepare_write)
 			stream->prepare_write(subreq);
-			__set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
+		__set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
-			netfs_stat(&netfs_n_wh_retry_write_subreq);
+		netfs_stat(&netfs_n_wh_retry_write_subreq);
-		} else {
-			struct iov_iter source;
-			netfs_reset_iter(subreq);
-			source = subreq->io_iter;
-			netfs_reissue_write(stream, subreq, &source);
-		}
 	}
 	netfs_unbuffered_write_done(wreq);

fs/netfs/internal.h+12−0

@@ -239,6 +239,18 @@ static inline bool netfs_is_cache_enabled(struct netfs_inode *ctx) · 238 unmodified lines
239	#endif	239	#endif
240	}	240	}
241		241
		242	static inline bool netfs_is_cache_maybe_enabled(struct netfs_inode *ctx)
		243	{
		244	#if IS_ENABLED(CONFIG_FSCACHE)
		245	struct fscache_cookie *cookie = ctx->cache;
		246
		247	return fscache_cookie_valid(cookie) &&
		248	test_bit(FSCACHE_COOKIE_IS_CACHING, &cookie->flags);
		249	#else
		250	return false;
		251	#endif
		252	}
		253
242	/*	254	/*
243	* Get a ref on a netfs group attached to a dirty page (e.g. a ceph snap).	255	* Get a ref on a netfs group attached to a dirty page (e.g. a ceph snap).
244	*/	256	*/

fs/netfs/locking.c+95−0

@@ -9,6 +9,11 @@ · 8 unmodified lines
9	#include <linux/netfs.h>	9	#include <linux/netfs.h>
10	#include "internal.h"	10	#include "internal.h"
11		11
		12	struct netfs_wb_waiter {
		13	struct list_head link; /* Link in ictx->wb_queue */
		14	struct task_struct waiter; / Waiter task; cleared when lock granted */
		15	};
		16
12	/*	17	/*
13	* inode_dio_wait_interruptible - wait for outstanding DIO requests to finish	18	* inode_dio_wait_interruptible - wait for outstanding DIO requests to finish
14	* @inode: inode to wait for	19	* @inode: inode to wait for
@@ -203,3 +208,93 @@ void netfs_end_io_direct(struct inode *inode) · 188 unmodified lines
203	up_read(&inode->i_rwsem);	208	up_read(&inode->i_rwsem);
204	}	209	}
205	EXPORT_SYMBOL(netfs_end_io_direct);	210	EXPORT_SYMBOL(netfs_end_io_direct);
		211
		212	/*
		213	* Wait to have exclusive access to writeback.
		214	*/
		215	static bool netfs_wb_begin_wait(struct netfs_inode *ictx)
		216	{
		217	struct netfs_wb_waiter waiter = {};
		218	struct task_struct *tsk = current;
		219	bool got = false;
		220
		221	spin_lock(&ictx->lock);
		222
		223	if (test_and_set_bit_lock(NETFS_ICTX_WB_LOCK, &ictx->flags)) {
		224	get_task_struct(tsk);
		225	waiter.waiter = tsk;
		226	list_add_tail(&waiter.link, &ictx->wb_queue);
		227	} else {
		228	got = true;
		229	}
		230	spin_unlock(&ictx->lock);
		231
		232	if (!got) {
		233	for (;;) {
		234	set_current_state(TASK_UNINTERRUPTIBLE);
		235	/* Read waiter before accessing inode state. */
		236	if (smp_load_acquire(&waiter.waiter) == NULL)
		237	break;
		238	schedule();
		239	}
		240	}
		241	__set_current_state(TASK_RUNNING);
		242	return true;
		243	}
		244
		245	/**
		246	* netfs_wb_begin - Begin writeback, waiting if need be
		247	* @ictx: The inode to get writeback access on
		248	* @nowait: Return failure immediately rather than waiting if true
		249	*
		250	* Begin writeback to an inode, waiting for exclusive access if @nowait is
		251	* false. This prevents collection from being done out of order with respect
		252	* to the issuance of write subrequests.
		253	*
		254	* Note that writeback may be ended in a different process (e.g. the collection
		255	* function on a workqueue) than started it.
		256	*
		257	* Return: True if can proceed, false if denied.
		258	*/
		259	bool netfs_wb_begin(struct netfs_inode *ictx, bool nowait)
		260	{
		261	if (!test_and_set_bit_lock(NETFS_ICTX_WB_LOCK, &ictx->flags))
		262	return true;
		263	if (nowait) {
		264	netfs_stat(&netfs_n_wb_lock_skip);
		265	return false;
		266	}
		267	netfs_stat(&netfs_n_wb_lock_wait);
		268	return netfs_wb_begin_wait(ictx);
		269	}
		270	EXPORT_SYMBOL(netfs_wb_begin);
		271
		272	/* netfs_wb_end - End writeback
		273	* @ictx: The inode we have writeback access to
		274	*
		275	* End writeback access on an inode, waking up the next writeback request.
		276	*/
		277	void netfs_wb_end(struct netfs_inode *ictx)
		278	{
		279	struct netfs_wb_waiter *waiter;
		280	struct task_struct *tsk;
		281
		282	WARN_ON_ONCE(!test_bit(NETFS_ICTX_WB_LOCK, &ictx->flags));
		283
		284	spin_lock(&ictx->lock);
		285
		286	waiter = list_first_entry_or_null(&ictx->wb_queue, struct netfs_wb_waiter, link);
		287	if (waiter) {
		288	list_del(&waiter->link);
		289	tsk = waiter->waiter;
		290	/* Write inode state before clearing waiter. */
		291	smp_store_release(&waiter->waiter, NULL);
		292	wake_up_process(tsk);
		293	put_task_struct(tsk);
		294	} else {
		295	clear_bit_unlock(NETFS_ICTX_WB_LOCK, &ictx->flags);
		296	}
		297
		298	spin_unlock(&ictx->lock);
		299	}
		300	EXPORT_SYMBOL(netfs_wb_end);

fs/netfs/read_retry.c+6−1

 			goto abandon;
 		}
-		list_for_each_continue(next, &stream->subrequests) {
+		for (;;) {
+			/* Read pointer to subreq before reading subreq state. */
+			next = smp_load_acquire(&next->next);
+			if (next == &stream->subrequests)
+				break;
 			subreq = list_entry(next, struct netfs_io_subrequest, rreq_link);
 			if (subreq->start + subreq->transferred != start + len ||
 			    test_bit(NETFS_SREQ_BOUNDARY, &subreq->flags) ||

fs/netfs/write_collect.c+10−0

@@ -408,6 +408,16 @@ bool netfs_write_collection(struct netfs_io_request *wreq) · 407 unmodified lines
408	netfs_wake_rreq_flag(wreq, NETFS_RREQ_IN_PROGRESS, netfs_rreq_trace_wake_ip);	408	netfs_wake_rreq_flag(wreq, NETFS_RREQ_IN_PROGRESS, netfs_rreq_trace_wake_ip);
409	/* As we cleared NETFS_RREQ_IN_PROGRESS, we acquired its ref. */	409	/* As we cleared NETFS_RREQ_IN_PROGRESS, we acquired its ref. */
410		410
		411	switch (wreq->origin) {
		412	case NETFS_WRITEBACK:
		413	case NETFS_WRITEBACK_SINGLE:
		414	case NETFS_WRITETHROUGH:
		415	netfs_wb_end(ictx);
		416	break;
		417	default:
		418	break;
		419	}
		420
411	if (wreq->iocb) {	421	if (wreq->iocb) {
412	size_t written = min(wreq->transferred, wreq->len);	422	size_t written = min(wreq->transferred, wreq->len);
413	wreq->iocb->ki_pos += written;	423	wreq->iocb->ki_pos += written;

fs/netfs/write_issue.c+24−31

 	_enter("R=%x", wreq->debug_id);
 	ictx = netfs_inode(wreq->inode);
-	if (is_cacheable && netfs_is_cache_enabled(ictx))
+	if (is_cacheable)
 		fscache_begin_write_operation(&wreq->cache_resources, netfs_i_cookie(ictx));
 	if (rolling_buffer_init(&wreq->buffer, wreq->debug_id, ITER_SOURCE) < 0)
 		goto nomem;
 	struct folio *folio;
 	int error = 0;
-	if (!mutex_trylock(&ictx->wb_lock)) {
+	if (!netfs_wb_begin(ictx, wbc->sync_mode == WB_SYNC_NONE))
-		if (wbc->sync_mode == WB_SYNC_NONE) {
+		return 0;
-			netfs_stat(&netfs_n_wb_lock_skip);
-			return 0;
-		}
-		netfs_stat(&netfs_n_wb_lock_wait);
-		mutex_lock(&ictx->wb_lock);
-	}
 	/* Need the first folio to be able to set up the op. */
 	folio = writeback_iter(mapping, wbc, NULL, &error);
 		}
 		error = netfs_write_folio(wreq, wbc, folio);
-		if (error < 0)
+		if (error == -ENOMEM) {
-			break;
+			folio_redirty_for_writepage(wbc, folio);
+			folio_unlock(folio);
+		}
 	} while ((folio = writeback_iter(mapping, wbc, folio, &error)));
 	netfs_end_issue_write(wreq);
-	mutex_unlock(&ictx->wb_lock);
 	netfs_wake_collector(wreq);
 	netfs_put_request(wreq, netfs_rreq_trace_put_return);
 	return error;
 couldnt_start:
-	netfs_kill_dirty_pages(mapping, wbc, folio);
+	if (error == -ENOMEM) {
+		folio_redirty_for_writepage(wbc, folio);
+		folio_unlock(folio);
+		folio = writeback_iter(mapping, wbc, folio, &error);
+		WARN_ON_ONCE(folio != NULL);
+	} else {
+		netfs_kill_dirty_pages(mapping, wbc, folio);
+	}
 out:
-	mutex_unlock(&ictx->wb_lock);
+	netfs_wb_end(ictx);
 	_leave(" = %d", error);
 	return error;
 }
 	struct netfs_io_request *wreq = NULL;
 	struct netfs_inode *ictx = netfs_inode(file_inode(iocb->ki_filp));
-	mutex_lock(&ictx->wb_lock);
+	netfs_wb_begin(ictx, false);
 	wreq = netfs_create_write_req(iocb->ki_filp->f_mapping, iocb->ki_filp,
 				      iocb->ki_pos, NETFS_WRITETHROUGH);
 	if (IS_ERR(wreq)) {
-		mutex_unlock(&ictx->wb_lock);
+		netfs_wb_end(ictx);
 		return wreq;
 	}
 	wreq->io_streams[0].avail = true;
+	__set_bit(NETFS_RREQ_OFFLOAD_COLLECTION, &wreq->flags);
 	trace_netfs_write(wreq, netfs_write_trace_writethrough);
 	return wreq;
 }
 ssize_t netfs_end_writethrough(struct netfs_io_request *wreq, struct writeback_control *wbc,
 			       struct folio *writethrough_cache)
 {
-	struct netfs_inode *ictx = netfs_inode(wreq->inode);
 	ssize_t ret;
 	_enter("R=%x", wreq->debug_id);
 	netfs_end_issue_write(wreq);
-	mutex_unlock(&ictx->wb_lock);
 	if (wreq->iocb)
 		ret = -EIOCBQUEUED;
 	else
 	if (WARN_ON_ONCE(!iov_iter_is_folioq(iter)))
 		return -EIO;
-	if (!mutex_trylock(&ictx->wb_lock)) {
+	if (!netfs_wb_begin(ictx, wbc->sync_mode == WB_SYNC_NONE)) {
-		if (wbc->sync_mode == WB_SYNC_NONE) {
+		/* The VFS will have undirtied the inode. */
-			/* The VFS will have undirtied the inode. */
+		netfs_single_mark_inode_dirty(&ictx->inode);
-			netfs_single_mark_inode_dirty(&ictx->inode);
+		return 1;
-			netfs_stat(&netfs_n_wb_lock_skip);
-			return 1;
-		}
-		netfs_stat(&netfs_n_wb_lock_wait);
-		mutex_lock(&ictx->wb_lock);
 	}
 	wreq = netfs_create_write_req(mapping, NULL, 0, NETFS_WRITEBACK_SINGLE);
 	smp_wmb(); /* Write lists before ALL_QUEUED. */
 	set_bit(NETFS_RREQ_ALL_QUEUED, &wreq->flags);
-	mutex_unlock(&ictx->wb_lock);
 	netfs_wake_collector(wreq);
 	netfs_put_request(wreq, netfs_rreq_trace_put_return);
 	return ret;
 couldnt_start:
-	mutex_unlock(&ictx->wb_lock);
+	netfs_wb_end(ictx);
 	_leave(" = %d", ret);
 	return ret;
 }

fs/netfs/write_retry.c+6−1

 		    !test_bit(NETFS_SREQ_NEED_RETRY, &from->flags))
 			return;
-		list_for_each_continue(next, &stream->subrequests) {
+		for (;;) {
+			/* Read pointer to subreq before reading subreq state. */
+			next = smp_load_acquire(&next->next);
+			if (next == &stream->subrequests)
+				break;
 			subreq = list_entry(next, struct netfs_io_subrequest, rreq_link);
 			if (subreq->start + subreq->transferred != start + len ||
 			    test_bit(NETFS_SREQ_BOUNDARY, &subreq->flags) ||

fs/ntfs/aops.c+2−4

 }
 static void ntfs_iomap_bio_submit_read(const struct iomap_iter *iter,
-	struct iomap_read_folio_ctx *ctx)
+		struct iomap_read_folio_ctx *ctx)
 {
-	struct bio *bio = ctx->read_ctx;
+	iomap_bio_submit_read_endio(iter, ctx, ntfs_iomap_read_end_io);
-	bio->bi_end_io = ntfs_iomap_read_end_io;
-	submit_bio(bio);
 }
 static const struct iomap_read_ops ntfs_iomap_bio_read_ops = {

fs/ntfs3/inode.c+1−4

 static void ntfs_iomap_bio_submit_read(const struct iomap_iter *iter,
 		struct iomap_read_folio_ctx *ctx)
 {
-	struct bio *bio = ctx->read_ctx;
+	iomap_bio_submit_read_endio(iter, ctx, ntfs_iomap_read_end_io);
-	bio->bi_end_io = ntfs_iomap_read_end_io;
-	submit_bio(bio);
 }
 static const struct iomap_read_ops ntfs_iomap_bio_read_ops = {

fs/orangefs/dir.c+4−3

 {
 	const int offset = sizeof(struct orangefs_readdir_response_s);
 	struct orangefs_khandle *khandle;
-	__u32 *len, padlen;
+	__u32 *len;
+	u64 padlen;
 	loff_t i;
 	char *s;
 	i = ctx->pos & ~PART_MASK;
 		 * len is the size of the string itself.  padlen is the
 		 * total size of the encoded string.
 		 */
-		padlen = (sizeof *len + *len + 1) +
+		padlen = (u64)sizeof *len + *len + 1;
-		    (8 - (sizeof *len + *len + 1)%8)%8;
+		padlen += (8 - padlen % 8) % 8;
 		if (part->len < i + padlen + sizeof *khandle)
 			goto next;
 		s = (void *)part + offset + i + sizeof *len;

fs/overlayfs/copy_up.c+10−2

 {
 	struct ovl_fs *ofs = OVL_FS(c->dentry->d_sb);
 	struct inode *udir = d_inode(c->destdir);
-	struct dentry *temp, *upper;
+	struct dentry *temp, *upper, *newdentry = NULL;
 	struct file *tmpfile;
 	int err;
 	err = PTR_ERR(upper);
 	if (!IS_ERR(upper)) {
 		err = ovl_do_link(ofs, temp, udir, upper);
+		if (!err) {
+			/*
+			 * Record the linked dentry -- not the disconnected
+			 * O_TMPFILE dentry -- so that ->d_revalidate() on
+			 * the upper fs sees the real parent/name.
+			 */
+			newdentry = dget(upper);
+		}
 		end_creating(upper);
 	}
 	if (!c->metacopy)
 		ovl_set_upperdata(d_inode(c->dentry));
-	ovl_inode_update(d_inode(c->dentry), dget(temp));
+	ovl_inode_update(d_inode(c->dentry), newdentry);
 out:
 	ovl_end_write(c->dentry);

fs/overlayfs/inode.c+2−2

  *
  * This chain is valid:
  * - inode->i_rwsem			(inode_lock[2])
- * - upper_mnt->mnt_sb->s_writers	(ovl_want_write[0])
  * - OVL_I(inode)->lock			(ovl_inode_lock[2])
+ * - upper_mnt->mnt_sb->s_writers	(ovl_want_write[0])
  * - OVL_I(lowerinode)->lock		(ovl_inode_lock[1])
  *
  * And this chain is valid:
  * held, because it is in reverse order of the non-nested case using the same
  * upper fs:
  * - inode->i_rwsem			(inode_lock[1])
- * - upper_mnt->mnt_sb->s_writers	(ovl_want_write[0])
  * - OVL_I(inode)->lock			(ovl_inode_lock[1])
+ * - upper_mnt->mnt_sb->s_writers	(ovl_want_write[0])
  */
 #define OVL_MAX_NESTING FILESYSTEM_MAX_STACK_DEPTH

fs/proc/generic.c+4−5

 	/* Add new node and rebalance tree. */
 	rb_link_node(&de->subdir_node, parent, new);
 	rb_insert_color(&de->subdir_node, root);
+	if (S_ISDIR(de->mode))
+		dir->nlink++;
 	return true;
 }
 		write_unlock(&proc_subdir_lock);
 		goto out_free_inum;
 	}
-	dir->nlink++;
 	write_unlock(&proc_subdir_lock);
 	return dp;
 {
 	rb_erase(&pde->subdir_node, &parent->subdir);
 	RB_CLEAR_NODE(&pde->subdir_node);
+	if (S_ISDIR(pde->mode))
+		parent->nlink--;
 }
 /*
 			de = NULL;
 		} else {
 			pde_erase(de, parent);
-			if (S_ISDIR(de->mode))
-				parent->nlink--;
 		}
 	}
 	write_unlock(&proc_subdir_lock);
 			continue;
 		}
 		next = de->parent;
-		if (S_ISDIR(de->mode))
-			next->nlink--;
 		write_unlock(&proc_subdir_lock);
 		proc_entry_rundown(de);

fs/xfs/xfs_aops.c+1−2

@@ -764,8 +764,7 @@ xfs_bio_submit_read( · 763 unmodified lines
764		764
765	/* defer read completions to the ioend workqueue */	765	/* defer read completions to the ioend workqueue */
766	iomap_init_ioend(iter->inode, bio, ctx->read_ctx_file_offset, 0);	766	iomap_init_ioend(iter->inode, bio, ctx->read_ctx_file_offset, 0);
767	bio->bi_end_io = xfs_end_bio;	767	iomap_bio_submit_read_endio(iter, ctx, xfs_end_bio);
768	submit_bio(bio);
769	}	768	}
770		769
771	static const struct iomap_read_ops xfs_iomap_read_ops = {	770	static const struct iomap_read_ops xfs_iomap_read_ops = {

fs/xfs/xfs_super.c+3−0

  out_free_rtdev_targ:
 	if (mp->m_rtdev_targp)
 		xfs_free_buftarg(mp->m_rtdev_targp);
+	mp->m_rtdev_targp = NULL;
+	rtdev_file = NULL;	/* released by xfs_free_buftarg() */
  out_free_ddev_targ:
 	xfs_free_buftarg(mp->m_ddev_targp);
+	mp->m_ddev_targp = NULL;
  out_close_rtdev:
 	 if (rtdev_file)
 		bdev_fput(rtdev_file);

include/linux/iomap.h+2−0

@@ -622,6 +622,8 @@ extern struct bio_set iomap_ioend_bioset; · 621 unmodified lines
622	#ifdef CONFIG_BLOCK	622	#ifdef CONFIG_BLOCK
623	int iomap_bio_read_folio_range(const struct iomap_iter *iter,	623	int iomap_bio_read_folio_range(const struct iomap_iter *iter,
624	struct iomap_read_folio_ctx *ctx, size_t plen);	624	struct iomap_read_folio_ctx *ctx, size_t plen);
		625	void iomap_bio_submit_read_endio(const struct iomap_iter *iter,
		626	struct iomap_read_folio_ctx *ctx, bio_end_io_t end_io);
625		627
626	extern const struct iomap_read_ops iomap_bio_read_ops;	628	extern const struct iomap_read_ops iomap_bio_read_ops;
627		629

include/linux/netfs.h+10−3

 #if IS_ENABLED(CONFIG_FSCACHE)
 	struct fscache_cookie	*cache;
 #endif
-	struct mutex		wb_lock;	/* Writeback serialisation */
+	struct list_head	wb_queue;	/* Queue of processes wanting to do writeback */
 	loff_t			_remote_i_size;	/* Size of the remote file */
 	loff_t			_zero_point;	/* Size after which we assume there's no data
 						 * on the server */
+	spinlock_t		lock;		/* Lock covering wb_queue */
 	atomic_t		io_count;	/* Number of outstanding reqs */
 	unsigned long		flags;
 #define NETFS_ICTX_ODIRECT	0		/* The file has DIO in progress */
 #define NETFS_ICTX_UNBUFFERED	1		/* I/O should not use the pagecache */
+#define NETFS_ICTX_WB_LOCK	2		/* Writeback serialisation lock */
 #define NETFS_ICTX_MODIFIED_ATTR 3		/* Indicate change in mtime/ctime */
 #define NETFS_ICTX_SINGLE_NO_UPLOAD 4		/* Monolithic payload, cache but no upload */
 };
 			      size_t *_cur_size, ssize_t size, gfp_t gfp);
 void netfs_free_folioq_buffer(struct folio_queue *fq);
+/* Writeback exclusion API. */
+bool netfs_wb_begin(struct netfs_inode *ictx, bool nowait);
+void netfs_wb_end(struct netfs_inode *ictx);
 /**
  * netfs_inode - Get the netfs inode context from the inode
  * @inode: The inode to query
 #if IS_ENABLED(CONFIG_FSCACHE)
 	ctx->cache = NULL;
 #endif
-	mutex_init(&ctx->wb_lock);
+	INIT_LIST_HEAD(&ctx->wb_queue);
+	spin_lock_init(&ctx->lock);
 	/* ->releasepage() drives zero_point */
 	if (use_zero_point) {
 		ctx->_zero_point = ctx->_remote_i_size;
 /**
  * netfs_resize_file - Note that a file got resized
- * @ctx: The netfs inode being resized
+ * @ictx: The netfs inode being resized
  * @new_i_size: The new file size
  * @changed_on_server: The change was applied to the server
  *

lib/iov_iter.c+19−1

 	struct folio *folio;
 	unsigned int nr = 0, offset;
 	loff_t pos = i->xarray_start + i->iov_offset;
+	bool will_alloc = !*pages;
 	XA_STATE(xas, i->xarray, pos >> PAGE_SHIFT);
 	offset = pos & ~PAGE_MASK;
 	}
 	rcu_read_unlock();
+	if (!nr) {
+		if (will_alloc) {
+			kvfree(*pages);
+			*pages = NULL;
+		}
+		return 0;
+	}
 	maxsize = min_t(size_t, nr * PAGE_SIZE - offset, maxsize);
 	iov_iter_advance(i, maxsize);
 	return maxsize;
 	bi.bi_bvec_done = skip;
 	maxpages = want_pages_array(pages, maxsize, skip, maxpages);
+	if (!maxpages)
+		return -ENOMEM;
 	while (bi.bi_size && bi.bi_idx < i->nr_segs) {
 		struct bio_vec bv = bvec_iter_bvec(i->bvec, bi);
 	unsigned long addr;
 	unsigned int gup_flags = 0;
 	size_t offset;
+	bool will_alloc = !*pages;
 	int res;
 	if (i->data_source == ITER_DEST)
 	if (!maxpages)
 		return -ENOMEM;
 	res = pin_user_pages_fast(addr, maxpages, gup_flags, *pages);
-	if (unlikely(res <= 0))
+	if (unlikely(res <= 0)) {
+		if (will_alloc) {
+			kvfree(*pages);
+			*pages = NULL;
+		}
 		return res;
+	}
 	maxsize = min_t(size_t, maxsize, res * PAGE_SIZE - offset);
 	iov_iter_advance(i, maxsize);
 	return maxsize;

lib/scatterlist.c+1−0

@@ -1366,6 +1366,7 @@ static ssize_t extract_xarray_to_sg(struct iov_iter *iter, · 1365 unmodified lines
1366	sg_max--;	1366	sg_max--;
1367		1367
1368	maxsize -= len;	1368	maxsize -= len;
		1369	start += len;
1369	ret += len;	1370	ret += len;
1370	if (maxsize <= 0 \|\| sg_max == 0)	1371	if (maxsize <= 0 \|\| sg_max == 0)
1371	break;	1372	break;

lib/tests/kunit_iov_iter.c+2−3

 	struct page **spages, **bpages;
 	u8 *scratch, *buffer;
 	size_t bufsize, npages, size, copied;
-	int i, b, patt;
+	int i, patt;
 	bufsize = 0x100000;
 	npages = bufsize / PAGE_SIZE;
 	KUNIT_EXPECT_EQ(test, iter.nr_segs, 0);
 	/* Build the expected image in the scratch buffer. */
-	b = 0;
 	patt = 0;
 	memset(scratch, 0, bufsize);
-	for (pr = bvec_test_ranges; pr->from >= 0; pr++, b++) {
+	for (pr = bvec_test_ranges; pr->from >= 0; pr++) {
 		u8 *p = scratch + pr->page * PAGE_SIZE;
 		for (i = pr->from; i < pr->to; i++)

tools/testing/selftests/filesystems/.gitignore+1−0

@@ -5,3 +5,4 @@ fclog · 4 unmodified lines
5	file_stressor	5	file_stressor
6	anon_inode_test	6	anon_inode_test
7	kernfs_test	7	kernfs_test
		8	idmapped_tmpfile

tools/testing/selftests/filesystems/Makefile+4−0

@@ -2,6 +2,10 @@ · 1 unmodified line
2		2
3	CFLAGS += $(KHDR_INCLUDES)	3	CFLAGS += $(KHDR_INCLUDES)
4	TEST_GEN_PROGS := devpts_pts file_stressor anon_inode_test kernfs_test fclog	4	TEST_GEN_PROGS := devpts_pts file_stressor anon_inode_test kernfs_test fclog
		5	TEST_GEN_PROGS += idmapped_tmpfile
5	TEST_GEN_PROGS_EXTENDED := dnotify_test	6	TEST_GEN_PROGS_EXTENDED := dnotify_test
6		7
7	include ../lib.mk	8	include ../lib.mk
		9
		10	$(OUTPUT)/idmapped_tmpfile: LDLIBS += -lcap
		11	$(OUTPUT)/idmapped_tmpfile: utils.c

tools/testing/selftests/filesystems/idmapped_tmpfile.c+168−0

@@ -0,0 +1,168 @@
	1	// SPDX-License-Identifier: GPL-2.0
	2	#define _GNU_SOURCE
	3
	4	#include <errno.h>
	5	#include <fcntl.h>
	6	#include <limits.h>
	7	#include <sched.h>
	8	#include <stdio.h>
	9	#include <unistd.h>
	10	#include <sys/fsuid.h>
	11	#include <sys/stat.h>
	12	#include <sys/syscall.h>
	13
	14	#include <linux/mount.h>
	15	#include <linux/types.h>
	16
	17	#include "kselftest_harness.h"
	18	#include "wrappers.h"
	19	#include "utils.h"
	20
	21	/*
	22	* The test mount maps caller-visible ids [0, MAP_RANGE) onto the on-disk range
	23	* [MAP_HOST, MAP_HOST + MAP_RANGE). An id outside [0, MAP_RANGE) therefore has
	24	* no mapping in the mount and is not representable in the filesystem.
	25	*/
	26	#define MAP_HOST 10000
	27	#define MAP_RANGE 10000
	28	#define UNMAPPED 50000
	29
	30	#ifndef MOUNT_ATTR_IDMAP
	31	#define MOUNT_ATTR_IDMAP 0x00100000
	32	#endif
	33
	34	#ifndef __NR_mount_setattr
	35	#define __NR_mount_setattr 442
	36	#endif
	37
	38	static inline int sys_mount_setattr(int dfd, const char *path,
	39	unsigned int flags,
	40	struct mount_attr *attr, size_t size)
	41	{
	42	return syscall(__NR_mount_setattr, dfd, path, flags, attr, size);
	43	}
	44
	45	/*
	46	* Clone @path into a detached mount idmapped so that caller-visible ids
	47	* [0, MAP_RANGE) map onto the on-disk ids [MAP_HOST, MAP_HOST + MAP_RANGE).
	48	* Returns the mount fd, or -1 if idmapped mounts are not available.
	49	*/
	50	static int idmapped_clone(const char *path)
	51	{
	52	struct mount_attr attr = {
	53	.attr_set = MOUNT_ATTR_IDMAP,
	54	};
	55	int fd_tree, userns_fd, ret;
	56
	57	fd_tree = sys_open_tree(AT_FDCWD, path,
	58	OPEN_TREE_CLONE \| OPEN_TREE_CLOEXEC);
	59	if (fd_tree < 0)
	60	return -1;
	61
	62	userns_fd = get_userns_fd(MAP_HOST, 0, MAP_RANGE);
	63	if (userns_fd < 0) {
	64	close(fd_tree);
	65	return -1;
	66	}
	67
	68	attr.userns_fd = userns_fd;
	69	ret = sys_mount_setattr(fd_tree, "", AT_EMPTY_PATH, &attr, sizeof(attr));
	70	close(userns_fd);
	71	if (ret) {
	72	close(fd_tree);
	73	return -1;
	74	}
	75
	76	return fd_tree;
	77	}
	78
	79	FIXTURE(idmapped_tmpfile) {
	80	char dir[64]; /* non-idmapped path to the layer directory */
	81	};
	82
	83	FIXTURE_SETUP(idmapped_tmpfile)
	84	{
	85	/* Private mount namespace so test mounts need no cleanup. */
	86	ASSERT_EQ(unshare(CLONE_NEWNS), 0);
	87	ASSERT_EQ(sys_mount(NULL, "/", NULL, MS_SLAVE \| MS_REC, NULL), 0);
	88	ASSERT_EQ(sys_mount("tmpfs", "/tmp", "tmpfs", 0, NULL), 0);
	89
	90	snprintf(self->dir, sizeof(self->dir), "/tmp/d");
	91	ASSERT_EQ(mkdir(self->dir, 0777), 0);
	92	/* World-writable so an unmapped caller still passes permission(). */
	93	ASSERT_EQ(chmod(self->dir, 0777), 0);
	94	}
	95
	96	FIXTURE_TEARDOWN(idmapped_tmpfile)
	97	{
	98	}
	99
	100	/*
	101	* A caller whose fsuid/fsgid have no mapping in the idmapped mount must not be
	102	* able to create an O_TMPFILE. Without the check in vfs_tmpfile() the inode
	103	* would be created owned by (uid_t)-1 and could then be linked into the
	104	* namespace.
	105	*/
	106	TEST_F(idmapped_tmpfile, unmapped_caller_is_refused)
	107	{
	108	int mfd, fd;
	109
	110	mfd = idmapped_clone(self->dir);
	111	if (mfd < 0)
	112	SKIP(return, "idmapped mounts not supported");
	113
	114	/* Become a caller outside the mount's [0, MAP_RANGE) range. */
	115	setfsgid(UNMAPPED);
	116	setfsuid(UNMAPPED);
	117	ASSERT_EQ(setfsuid(-1), UNMAPPED);
	118
	119	fd = openat(mfd, ".", O_TMPFILE \| O_WRONLY, 0644);
	120	ASSERT_LT(fd, 0);
	121	EXPECT_EQ(errno, EOVERFLOW);
	122	if (fd >= 0)
	123	close(fd);
	124
	125	EXPECT_EQ(close(mfd), 0);
	126	}
	127
	128	/*
	129	* A mapped caller can create an O_TMPFILE and link it into the namespace; the
	130	* ownership round-trips through the mount idmap. This is what makes refusing
	131	* the unmapped case above necessary in the first place.
	132	*/
	133	TEST_F(idmapped_tmpfile, mapped_caller_creates_and_links)
	134	{
	135	char path[PATH_MAX];
	136	struct stat st;
	137	int mfd, fd;
	138
	139	mfd = idmapped_clone(self->dir);
	140	if (mfd < 0)
	141	SKIP(return, "idmapped mounts not supported");
	142
	143	/* Caller is uid/gid 0, which maps to MAP_HOST through the mount. */
	144	fd = openat(mfd, ".", O_TMPFILE \| O_RDWR, 0600);
	145	ASSERT_GE(fd, 0);
	146
	147	ASSERT_EQ(fstat(fd, &st), 0);
	148	EXPECT_EQ(st.st_uid, 0);
	149	EXPECT_EQ(st.st_gid, 0);
	150
	151	/* The tmpfile is linkable: splice it into the directory. */
	152	ASSERT_EQ(linkat(fd, "", mfd, "linked", AT_EMPTY_PATH), 0);
	153	EXPECT_EQ(close(fd), 0);
	154
	155	ASSERT_EQ(fstatat(mfd, "linked", &st, 0), 0);
	156	EXPECT_EQ(st.st_uid, 0);
	157	EXPECT_EQ(st.st_gid, 0);
	158
	159	/* On the underlying, non-idmapped tmpfs it is stored as MAP_HOST. */
	160	snprintf(path, sizeof(path), "%s/linked", self->dir);
	161	ASSERT_EQ(stat(path, &st), 0);
	162	EXPECT_EQ(st.st_uid, MAP_HOST);
	163	EXPECT_EQ(st.st_gid, MAP_HOST);
	164
	165	EXPECT_EQ(close(mfd), 0);
	166	}
	167
	168	TEST_HARNESS_MAIN