Commit 1dbb7422053f for kernel

commit 1dbb7422053fa0f4fb5f9acc3931617fc0091939
Merge: 519abe8d9acb 214897acc8c2
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Oct 16 07:53:16 2026 -0700

    Merge tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

    Pull vfs fixes from Christian Brauner:

     - Fix a range of use-after-frees during rcu pathwalk caused by non-rcu
       frees.

       Whatever ->permission(), ->d_revalidate(), ->get_link(), ->d_hash()
       and ->d_compare() read in rcu mode has to be freed after a grace
       period. umount(2) hides most of it because namespace_unlock() waits
       for one, but a chdir() out of a lazily unmounted directory or the
       close() of the last file on it drops the last reference without.

        * ext4_get_link() reads the sbi and the extent status counters for a
          symlink stored in a data block. Both are freed after a grace
          period now.

        * The unicode map of casefolded ext4, f2fs and tmpfs was freed under
          generic_ci_d_hash() and generic_ci_d_compare().

        * ntfs3 with nocase freed its sbi and mount options under its dentry
          hash and compare. A remount freed the old options right away too.

        * eventfs freed an eventfs_inode after an SRCU grace period only
          while tracefs_d_revalidate() reads it under rcu_read_lock().

        * afs and 9p are only saved by the grace period their private bdi
          gets in bdi_unregister(). They stop depending on it.

        * create_ipc_ns() leaked the mqueue mount and its superblock on a
          late failure. A long-term mount needs kern_unmount().

     - Don't let idle threads pin the initramfs.

       The idle threads of the secondary cpus are forked from PID 1 with a
       private copy of its fs_struct, aren't on the task list so
       pivot_root() never moves them and never exit. So the initramfs stayed
       pinned forever on every machine with more than one cpu, 70 to 150 MB
       in the reports. They share init_fs now like init_task does.

     - A mount that copy_tree() leaves out can't take over a lock.

       copy_tree() drops mounts of mount namespace files from the copies it
       makes for unshare(CLONE_NEWNS) and propagation without looking at
       MNT_LOCKED. So root in a user namespace could bind a child's
       /proc/<pid>/ns/mnt beneath a locked cover, let it take the lock over,
       unshare(CLONE_NEWNS) and read the file. copy_tree() refuses with
       EPERM now and the move beneath a locked mount is refused up front.

     - Revert "namei: don't reveal overmounted entries in refwalk" from the
       rc7 fixes. The bug class is bigger than that patch.

     - namei: lookup_fast_for_open() checked ->d_inode while
       traverse_mounts() checks the type in d_flags, which is set second, so
       a refwalk racing the instantiation could fail an O_CREAT open with
       ENOENT. Use d_is_negative() in both places.

     - Drop the smp_mb()s in mntput_no_expire_slowpath() and do_umount()
       that mnt_get_count()'s own barrier made redundant.

     - fsnotify: a mark added while fsnotify_destroy_marks() walks the
       connector could be missed and the connector detached, so an fdinfo
       read called igrab(NULL). New marks are refused during teardown.

     - pipe: a failed second fasync enable on an O_RDWR FIFO removed the
       existing reader entry and cleared FASYNC while the writer entry
       stayed, a use-after-free in send_sigio() later.

     - watch_queue: post_one_notification() could see nr_notes before the
       note pool behind it and dereference a NULL array. An unprivileged
       user can trigger that with a key watch. Publish nr_notes last.

     - pid_namespace: zap_pid_ns_processes() waits without bound for a
       tracer outside the namespace to reap its zombies and neither wait was
       freezable, so every suspend attempt failed.

     - exit: is_child_subreaper and has_child_subreaper shared a word with
       other bitfields written without a common lock, so racing prctl()s
       lost a bit. They are separate bools now.

     - autofs: a notification write that failed on a pipe the daemon had
       already replaced put the superblock into catatonic mode again and
       closed the replacement. Only do that for the current pipe.

     - ovl: reject a lowerdir ending with an unescaped backslash with EINVAL
       instead of a confusing ENOENT later.

     - ocfs2/dlm: take dlm_reco_state_lock when the debugfs state file walks
       the recovery participant list.

     - samples/pidfd: fix the userprogs typo that kept pidfd-metadata from
       being built.

    * tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
      Revert "namei: don't reveal overmounted entries in refwalk"
      selftests/filesystems: test that a mntns file can't take over a lock
      fs: let idle threads share init_fs
      namespace: a mount that copy_tree() leaves out can't take over a lock
      namei: test for a negative dentry the way traverse_mounts() does
      fs: pass flags to copy_fs()
      ovl: reject lowerdir ending with unescaped backslash
      fsnotify: prevent mark additions during connector teardown
      pid_namespace: make zap_pid_ns_processes() freezable
      fs: drop the smp_mb()s that mnt_get_count() made redundant
      autofs: ignore notification errors from a replaced pipe
      ntfs3: free replaced mount options after a grace period
      ntfs3: free the sbi after a grace period
      unicode: free the map after a grace period
      ipc: drop the mqueue mount with kern_unmount() on setup failure
      eventfs: free the eventfs_inode after an rcu grace period too
      9p: free the session after a grace period
      watch_queue: Fix note pool publication race in watch_queue_set_size()
      afs: free the super info after a grace period
      pipe: preserve existing fasync readers on writer setup failure
      ...