Commit dd6c438c3e64 for kernel

commit dd6c438c3e64a5ff0b5d7e78f7f9be547803ef1b
Merge: bd1886d6e4ca ac8777cc3622
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Apr 23 17:08:04 2026 -0700

    Merge tag 'vfs-7.1-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

    Pull vfs fixes from Christian Brauner:

     - eventpoll: fix ep_remove() UAF and follow-up cleanup

     - fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference
       error

     - writeback: Fix use after free in inode_switch_wbs_work_fn()

     - fuse: reject oversized dirents in page cache

     - fs: aio: reject partial mremap to avoid Null-pointer-dereference
       error

     - nstree: fix func. parameter kernel-doc warnings

     - fs: Handle multiply claimed blocks more gracefully with mmb

    * tag 'vfs-7.1-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
      eventpoll: drop vestigial epi->dying flag
      eventpoll: drop dead bool return from ep_remove_epi()
      eventpoll: refresh eventpoll_release() fast-path comment
      eventpoll: move f_lock acquisition into ep_remove_file()
      eventpoll: fix ep_remove struct eventpoll / struct file UAF
      eventpoll: move epi_fget() up
      eventpoll: rename ep_remove_safe() back to ep_remove()
      eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
      eventpoll: kill __ep_remove()
      eventpoll: split __ep_remove()
      eventpoll: use hlist_is_singular_node() in __ep_remove()
      fs: Handle multiply claimed blocks more gracefully with mmb
      nstree: fix func. parameter kernel-doc warnings
      fs: aio: reject partial mremap to avoid Null-pointer-dereference error
      fuse: reject oversized dirents in page cache
      writeback: Fix use after free in inode_switch_wbs_work_fn()
      fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error