Commit aa98230e410f for kernel

commit aa98230e410f0ed212b6788c46b1e4d49e0ff7ca
Merge: a2ff1b626e1c b78b728e21c3
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 25 11:12:06 2026 -0700

    Merge tag 'vfs-7.3-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

    Pull vfs fixes from Christian Brauner:

     - Revert "put_mnt_ns(): leave mounts connected". This allows the
       creation of reference count cycles in a very trivial way. We can't
       bring this in until we have fixed the underlying cause

     - vfs: Don't create the private nullfs instance for kthreads under
       namespace_sem to avoid false lockdeps complaints

     - binfmt_misc:
         - Copy the name into a stack buffer and look up the copy in
           bpf_binprm_select_interp()
         - bpf_binprm_set_interp() and bpf_binprm_set_interp_arg(): Check
           the private copy instead so the string that gets staged is the
           kstring that was checked

     - netfs:
         - Make netfs_read_gaps() use separate sink folios rather than one
           reused sink folio to discard unwanted data so that cifs checksum
           checking sees all the data that was fetched
         - Trim reads down to i_size so afs symlinks read correctly from the
           cache
         - Wrap the direct mempool ->alloc() calls the GFP_KERNEL paths make
           in alloc_hooks() via a new mempool_alloc_noreserve() helper

     - iov_iter: Use iov_iter_alignment() for the start and length check
       added to iov_iter_extract_bvecs() this cycle. It used iter_iov_addr()
       and iter_iov_len() which are only valid for ITER_UBUF and ITER_IOVEC
       iterators

     - super: Make iterate_supers_type() deletion-safe

     - inode: Stop evict_inodes() from rescanning the same inodes

     - writeback: Bound the cleanup_offline_cgwb() rescans

     - ntfs3: Use d_instantiate_new() in ntfs_create_inode()

     - ovl: Fix a use-after-free in the ovl_do_mkdir() debug print

     - dcache: Unpoison the inline name buffer in __d_alloc() for KMSAN

     - autofs: Fix a pipe file reference leak in autofs_kill_sb()

     - bpf: Drop the path_unlink and path_rmdir hooks from the list of hooks
       for which the verifier rewrites bpf_{set,remove}_dentry_xattr() to
       the _locked variants

     - squashfs: Range check the xz dictionary size before shifting by it

     - selftests: Add the missing eventfd, open_tree_ns, openat2 and xattr
       filesystems selftests to TARGETS and drop the stale openat2 entry
       left behind when those tests moved

    * tag 'vfs-7.3-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
      netfs: Fix missing alloc tagging of direct mempool allocations
      bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
      autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
      dcache: unpoison the inline name buffer in __d_alloc()
      ovl: fix UAF in ovl_do_mkdir() debug print
      super: make iterate_supers_type() deletion-safe
      Revert "put_mnt_ns(): leave mounts connected"
      Revert "selftests/filesystems: add mntns cleanup test"
      binfmt_misc: fix racy checks in bpf set_interp kfuncs
      binfmt_misc: fix OOB read in bpf_binprm_select_interp()
      fs: don't create the private nullfs mount under namespace_sem
      writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
      fs: avoid repeated scans in evict_inodes()
      netfs, afs: Fix symlink reading
      netfs: Fix netfs_read_gaps() to use separate sink folios
      squashfs: Add dictionary size range check to prevent shift-out-of-bounds
      fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
      selftests/filesystems: fix missing and stale TARGETS entries
      block: Fix start and length check added to iov_iter_extract_bvecs()