Commit 5f5be6584cf5 for kernel

commit 5f5be6584cf5af0d70ee2fd40aa6264da18617ec
Merge: 05e72bd33859 1448959fe3d0
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Nov 10 07:25:09 2026 -0800

    Merge tag 'vfs-7.4-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

    Pull vfs fixes from Christian Brauner:

     - libfs: Make readdir on tmpfs walk the offset tree in offset order
       instead of d_children to avoid skipping entries or relisting the
       whole directory

       It's faster too. Listing a million entries takes 114ms instead of
       146ms, and 113ms instead of 470ms with four processes listing in
       parallel

     - iomap: Finish the ->iomap_next() conversion that started in v7.3

       The nilfs2 and fuse ext_map iomap code added this merge window is
       converted so now we can remove the ->iomap_begin()/->iomap_end()
       fallback. We waited until the new iomap users from other trees were
       in mainline otherwise this would have been very messy

     - errseq: Retry with the current value when the cmpxchg() in
       errseq_check_and_advance() fails to avoid an old value coming back
       later hiding the errors

     - aio: Hold an extra count for exit_aio() itself so it can't return
       before the last free_ioctx_reqs() callback has called complete()

     - pidfd: Fail the namespace ioctls with EREMOTE unless the target is
       visible in the caller's pid namespace like PIDFD_GET_INFO does

     - eventpoll: Wake the next waiter when a woken waiter returns early
       because of a fatal signal to avoid sleeping forever

     - backing-file: Pass RWF_NOAPPEND on to synchronous writes to the
       backing file

     - initrd: Flush the deferred fput() of the ramdisk file before mounting
       root

     - iov_iter: Take an unsigned long segment count in import_iovec()

       The upper 32 bits of the count passed to readv(), writev() and
       friends were dropped before the UIO_MAXIOV check

     - splice: Advance the pipe tail before checking for a full bvec array
       in splice_to_socket(). The last buffer was counted again, so MSG_MORE
       was set although the pipe was empty and small TCP transfers waited
       for the cork timeout

     - vfs:

         - Reject negative offsets for SEEK_DATA and SEEK_HOLE in
           default_llseek() and use must_set_pos() for its whence handling

         - Only clear tv_nsec in timestamp_truncate() when clamping changed
           the seconds. Timestamps whose seconds were exactly at a
           filesystem time limit lost their subsecond part

         - Don't leak the kernel-internal STATX_ATTR_CHANGE_MONOTONIC in
           stx_attributes_mask

         - Clamp the FIONREAD result to the int range so a file with 4 GiB
           left isn't reported as empty

         - Fix the SEEK_CUR f_lock check

     - selftests: Fix the statmount and mount_setattr tests on 32-bit and
       s390, build the fchmodat2 and openat2 tests without sanitizers when
       the toolchain lacks the runtimes and fix a clang warning in the
       mount-notify test

     - docs: Fix a docutils warning in porting.rst

    * tag 'vfs-7.4-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits)
      fs: fix the SEEK_CUR f_lock condition
      splice, net: avoid MSG_MORE when the bvec array fills
      aio: don't let exit_aio() return before complete() is done
      fs: porting.rst: use literal string to avoid warning
      selftests/fs/mount-notify: fix the indentation in the fsmount test
      selftests: probe for sanitizer support in fchmodat2 and openat2
      selftests/mount_setattr: build with a 64-bit off_t
      selftests/statmount: fix format warnings on 32-bit and s390
      fs: use must_set_pos() in default_llseek()
      fs: reject negative offsets for SEEK_DATA and SEEK_HOLE in default_llseek()
      pidfd: restrict task access ioctls to the caller's pid namespace
      fs: clamp FIONREAD result to int range
      eventpoll: wake the next waiter when a woken waiter is killed
      statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask
      vfs: preserve subsecond timestamps at filesystem time limits
      iov_iter: take an unsigned long segment count in import_iovec()
      lib/tests: errseq: add a concurrent check_and_advance test
      errseq: don't let errseq_check_and_advance() hide later errors
      backing-file: pass RWF_NOAPPEND to synchronous writes
      initrd: flush deferred fput() before mounting root
      ...

diff --cc fs/xfs/xfs_file.c
index 396aca8c66a9,e772347aff9a..d61ea8e2c8e4
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@@ -722,10 -764,9 +722,10 @@@ xfs_file_dio_write_aligned
  	if (mapping_stable_writes(iocb->ki_filp->f_mapping))
  		dio_flags |= IOMAP_DIO_BOUNCE;
  	trace_xfs_file_direct_write(iocb, from);
- 	ret = iomap_dio_rw(iocb, from, ops, dops, dio_flags, ac, 0);
+ 	ret = iomap_dio_rw(iocb, from, next, dops, dio_flags, ac, 0);
  out_unlock:
 -	xfs_iunlock(ip, iolock);
 +	if (iolock)
 +		xfs_iunlock(ip, iolock);
  	return ret;
  }