Commit bd1dde877520 for kernel

commit bd1dde877520385f6638af2d0f2bd4f212eb8f34
Merge: a84c80421506 c679ce3be6cb
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Aug 2 10:12:21 2026 -0700

    Merge tag 'vfs-7.2-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

    Pull vfs fixes from Christian Brauner:
     "binfmt_misc:

       - Don't let an 'F' entry pin its own instance.

         An entry registered with 'F' opens its interpreter at registration
         time and holds that file until the entry is freed, so an entry
         nobody removes by hand is only closed once the binfmt_misc
         superblock is shut down.

         If the interpreter lives on a mount that keeps that superblock
         alive the two pin each other and the file is never closed. That's
         reachable by pointing the interpreter at the instance itself or by
         using the instance as an overlayfs lower layer, and once the mount
         namespace is gone there's nothing left to unregister through
         either.

       - Restore write access when removing an entry.

         Registering with the MISC_FMT_OPEN_FILE flag opens the interpreter
         via open_exec() which denies write access for as long as the entry
         exists, but removal only did filp_close() and never restored it.
         The inode's i_writecount stayed permanently negative and opening
         the interpreter for writing kept failing with ETXTBSY long after
         the entry was gone.

       - Use exe_file_deny_write_access() for the interpreter clone so both
         sides base their decision on the same mode.

       - Reject a flag character as the field delimiter. create_entry() pads
         the buffer with the delimiter so the field parsers terminate even
         on a truncated string, but check_special_flags() consumes flag
         characters instead of scanning for the delimiter.

         If the delimiter is itself a flag character the padding stops
         acting as a terminator and the scan keeps reading past the end of
         the allocation. Such a registration was always rejected, just only
         after the out of bounds read has already happened.

       - Don't leak the user namespace when the mount fails.

         bm_get_tree() hands its reference to get_tree_keyed() and sget_fc()
         moves it into sb->s_fs_info, but generic_shutdown_super() only
         calls ->put_super() from inside the if (sb->s_root) branch and
         bm_fill_super() can fail before either s_root or s_op is in place.

         Drop the reference in ->kill_sb() instead, which runs
         unconditionally.

      netfs:

       - Clear PG_private_2 on a copy-to-cache append failure.

       - Handle a rolling buffer allocation failure in single-object
         writeback and drop the extra folio reference
         netfs_write_folio_single() took before the append.

       - Release the previously batched readahead folios when
         rolling_buffer_load_from_ra() fails in
         netfs_prepare_read_iterator()

       - Fix the folio_queue ENOMEM in writeback by adding a mempool and
         passing gfp flags into the rolling buffer helpers.

      iomap:

       - Add a separate bio_set for iomap_split_ioend(). It can split bios
         that already come from iomap_ioend_bioset and deadlock once that
         bioset is exhausted.

      afs:

       - Set call->async for an asynchronous afs_fs_fetch_data() the way
         afs_fs_fetch_data64() already does.

       - Subtract subreq->transferred from subreq->len in
         afs_fs_fetch_data() rather than adding it.

       - Fix a UAF when sending a message"

    * tag 'vfs-7.2-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
      iomap: add a separate bio_set for iomap_split_ioend
      binfmt_misc: don't leak the user namespace when the mount fails
      binfmt_misc: reject a flag character as the field delimiter
      binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
      binfmt_misc: restore write access when removing an entry
      binfmt_misc: don't let an 'F' entry pin its own instance
      netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
      netfs: release readahead folios on iterator preparation failure
      netfs: handle single writeback rolling buffer allocation failure
      netfs: clear PG_private_2 on copy-to-cache append failure
      afs: Fix UAF when sending a message
      afs: Fix afs_fs_fetch_data() to subtract transferred from len
      afs: Fix afs_fs_fetch_data() to set call->async