Merge tag 'vfs-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull misc vfs updates from Christian Brauner:
"Bigger cleanups:

- The lockref dead-count handling is tidied

Merge tag 'vfs-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull misc vfs updates from Christian Brauner:
"Bigger cleanups:

- The lockref dead-count handling is tidied up.

The open-coded check for a count below zero as the dead marker
relies on information the caller should not have.

- make put_mnt_ns() leave mounts connected. Destroying a mount
namespace disconnected its mounts from their mount points. So a
file descriptor still open on the parent of a mount point could be
used to peek under it.

Locked mounts were already kept connected to prevent exactly that.
But a mount is only locked when its tree is copied across a user
namespace boundary. So a mount namespace set up by a privileged
component had no locked mounts and its mounts were disconnected.
Passing UMOUNT_CONNECTED keeps every mount connected and prevents
that bug.

- vfs_prepare_mode() passes S_IFDIR for directories. I meant to fix
that ago but didn't get to it. So now someone finally did it.

This kills the exception where the mode could be 0 when a directory
was created whereas every other creation operation passed it
explicitly already.

- move long delayed work for ufs, jffs2, hfsplus, hfs and affs from
the per-cpu system_long_wq to the new unbound system_dfl_long_wq.

None of that work relies on per-cpu state and the work item is
enqueued with queue_delayed_work() whose timer is global anyway. So
it may as well benefit from scheduler task placement.

Smaller fixes and cleanups:

- unlock_buffer() and journal_end_buffer_io_sync() use
clear_and_wake_up_bit()

- the pipe page pools are unified into a single per-pipe pool and the
extra wake_up(rd_wait) is limited to EPOLLET consumers

- eventpoll now computes its timer slack lazily in ep_poll()

- shrink_dcache_for_umount() keeps making progress on busy roots

- excess xarray nodes are freed in clear_inode()

- romfs detects hard link cycles

- the user path of nested backing files is fixed

- pidfd holds exec_update_lock around the namespace ioctl

- non-memcg-aware nr_cached_objects is skipped during memcg slab
shrink

- iomap_write_iter() always returns status

- mangle_path() is renamed to seq_mangle_path()

- inode timestamp accessors are annotated

- new regression test for pipe->poll_usage.

- a few documentation, kernel-doc and selftest fixes"

* tag 'vfs-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (67 commits)
selftests/namespaces: Fix racy pipe handshake in timens and pidns_separate
selftests/epoll: add a regression test for pipe->poll_usage
pipe: only enable the extra wake_up(rd_wait) for EPOLLET consumers
pidfd: hold exec_update_lock around namespace ioctl
fs: fix user path of nested backing files
fs: remove stale inode_insert5() kernel-doc parameter
fs: fix switch/case indentation in sysfs() syscall
fs: document semantics of kstat::{uid,gid} fields
dcache: keep shrink_dcache_for_umount() making progress on busy roots
seq_file: rename mangle_path to seq_mangle_path
nstree: add/fix struct ns_id_req kernel-doc member fields
dcache: use lockref routines for dead count checks
lockref: tidy up dead count handling
initramfs: fix typo in reserve_initrd_mem comment
fs/pipe: unify the page pools into a single per-pipe pool
fs: annotate inode timestamp accessors
eventpoll: compute timer slack lazily in ep_poll()
selftests/filesystems: add mntns cleanup test
put_mnt_ns(): leave mounts connected
affs: Move long delayed work on system_dfl_long_wq
...

show more ...

Merge patch series "put_mnt_ns(): leave mounts connected"

Noah Orlando <Noah.Orlando@deshaw.com> says:

When a mount namespace is destroyed, put_mnt_ns() disconnects its mounts
from their mount poin

Merge patch series "put_mnt_ns(): leave mounts connected"

Noah Orlando <Noah.Orlando@deshaw.com> says:

When a mount namespace is destroyed, put_mnt_ns() disconnects its mounts
from their mount points. A file descriptor still open on the parent of a
mount point can then be used to look under the mount point.

Locked mounts are kept connected to prevent this. However, a mount is
only locked when its tree is copied across a user namespace boundary. A
mount namespace set up by a privileged component has no locked mounts,
so its mounts are disconnected.

Pass UMOUNT_CONNECTED so every mount is kept connected, as locked mounts
already are.

* patches from https://patch.msgid.link/20260706182559.2496448-2-Noah.Orlando@deshaw.com:
selftests/filesystems: add mntns cleanup test
put_mnt_ns(): leave mounts connected

Link: https://patch.msgid.link/20260706182559.2496448-2-Noah.Orlando@deshaw.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

show more ...

selftests/filesystems: add mntns cleanup test

Verify that destroying a mount namespace keeps its mounts connected.

Signed-off-by: Noah Orlando <Noah.Orlando@deshaw.com>
Link: https://patch.msgid.li

selftests/filesystems: add mntns cleanup test

Verify that destroying a mount namespace keeps its mounts connected.

Signed-off-by: Noah Orlando <Noah.Orlando@deshaw.com>
Link: https://patch.msgid.link/20260706182559.2496448-4-Noah.Orlando@deshaw.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

show more ...