)]}'
{
  "commit": "f99005fbed4e8071110faa350cc5fa453afa1455",
  "tree": "2e5e41e0cadba5b7c961a82a7c17d00439bf0751",
  "parents": [
    "9515f634dbed2bb8928fbb3b01102dd4e64f4aeb",
    "3d399224425573875b6f6f1181bd8cf9a28cc7d1"
  ],
  "author": {
    "name": "Linus Torvalds",
    "email": "torvalds@linux-foundation.org",
    "time": "Fri Oct 09 23:37:44 2026 +0200"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@linux-foundation.org",
    "time": "Fri Oct 09 23:37:44 2026 +0200"
  },
  "message": "Merge tag \u0027vfs-7.3-rc7.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n \"This contains fixes for the current development cycle.\n\n  All of them came out of a review of the mount code that started with a\n  bug report. The review modeled the corner cases of mount propagation,\n  unmounting and mount reference counting and turned up a lot of bugs.\n  Most of them years old. Most fixes come with a selftest.\n\n   - Rework connected mounts.\n\n     A mount that is unmounted together with its parent can stay\n     attached to the parent to keep its mountpoint covered. That happens\n     when the mountpoint is removed with rmdir(), unlink() or rename(),\n     when a detached tree is dissolved, and for locked mounts in any\n     umount that isn\u0027t synchronous, including the teardown of their\n     mount namespace. The parent then owns the child and drops it on its\n     own final mntput(). So any reference from the child\u0027s superblock\n     back to one of its ancestors becomes a cycle that is never freed.\n\n     A loop device backed by an image on a tmpfs and mounted on that\n     same tmpfs is enough. Remove the directory the tmpfs is mounted on\n     from the host, let the container\u0027s mount namespace exit, and the\n     loop device, the tmpfs and the filesystem on the loop device are\n     leaked for good. The same works with autofs, zram, ecryptfs,\n     binfmt_misc, fuse passthrough, zloop, a mass storage gadget and md,\n     and the selftests have reproducers for them. This has been possible\n     since v4.1. It is also why \"put_mnt_ns(): leave mounts connected\"\n     was reverted in -rc5. Keeping every mount of a dying mount\n     namespace connected made these cycles trivial to create.\n\n     Every unmounted mount is now detached from its parent. Where the\n     mountpoint has to stay covered the mount leaves a cover on the\n     parent instead, allocated together with the mount. A lookup on the\n     unmounted parent that hits a cover finds an empty immutable\n     directory or file on the private nullfs instance. Nothing leads\n     from a cover to another mount, so no unmounted mount owns another\n     one and no cycle can form.\n\n     This is visible to userspace. A formerly connected mount can no\n     longer be reached through its unmounted parent and \"..\" inside it\n     leads nowhere, as for every other lazily unmounted mount.\n\n     With that the private nullfs instance becomes reachable from\n     userspace, so it now refuses mounts on top, is mounted read-only,\n     and refuses fsnotify marks and file locks. Its inodes are shared by\n     every holder and a watch or a lock would otherwise reach across\n     users. may_decode_fh() now also decides its subtree check under a\n     single mount_lock hold, as a racing umount could otherwise let it\n     decode into what a locked child covered.\n\n   - umount:\n\n     * Don\u0027t silently unmount busy mounts.\n\n       Since v4.13 propagate_umount() takes down propagated copies of\n       the victim with children as long as each child is an overmount or\n       another copy of the victim, but propagate_mount_busy() only ever\n       checked copies without children or with just an overmount. A\n       container that moved a tree beneath its copy of a host mount lost\n       that tree from under its open file descriptor to a plain umount()\n       on the host. propagate_mount_busy() now applies the same rules,\n       walking each chain of copies once.\n\n     * Don\u0027t let a migrating task hide its reference from umount().\n\n       mnt_get_count() sums the per-cpu counters under mount_lock but\n       the mntget() and mntput() fast paths don\u0027t take it. A task that\n       takes a reference on a cpu the sum has already passed and drops\n       it after migrating to one the sum hasn\u0027t reached yet hides the\n       reference it held to begin with, and umount() succeeds with the\n       file still open. Gets and puts now live in separate per-cpu\n       counters and all puts are summed before all gets with a full\n       barrier in between, the way srcu_readers_active_idx_check() does\n       it. mntget() is unchanged and mntput() gains an smp_wmb().\n\n     * Check each submount for references right before unmounting it.\n\n       shrink_submounts() and mark_mounts_for_expiry() checked all their\n       victims up front. Unmounting the first could move a busy\n       overmount to where the next victim\u0027s propagated copy is looked up\n       and it was then unmounted without a check.\n\n     * Never expire a locked mount.\n\n       A shrinkable mount moved beneath a locked mount with\n       MOVE_MOUNT_BENEATH takes over the lock, and umount() of an\n       unlocked ancestor expired it and revealed what it covered. That\n       umount() now fails with EBUSY as it does for any other locked\n       child. A lazy umount still takes the whole tree.\n\n   - Overmounts and locked mounts:\n\n     * Unhash a dentry before detaching the mounts on it.\n\n       unlink(), rmdir() and rename() detach the mounts on the victim\n       but only d_delete() it once its inode is unlocked, a window that\n       includes an expedited RCU grace period. In between, a lookup from\n       a mount namespace in which the dentry is a mountpoint found it\n       hashed, positive and uncovered. Drop the dentry first, as\n       d_invalidate() already does.\n\n     * Don\u0027t reveal overmounted entries in refwalk.\n\n       A refwalk that had grabbed the dentry before the unlink never\n       rechecked it the way rcuwalk does with d_seq and mount_lock.\n       Without any artificial widening three walkers read the covered\n       file 27 times in a minute. step_into() now fails an unhashed\n       dentry marked DCACHE_CANT_MOUNT with -ESTALE and the walk is\n       retried.\n\n     * Keep covered mounts covered in OPEN_TREE_NAMESPACE.\n\n       Creating such a mount namespace only takes a user namespace and\n       the copy followed bind mount rules: no children without\n       AT_RECURSIVE and no unbindable mounts with it. An unprivileged\n       user could see what mounts covered in the source, such as the\n       parts of /proc and /sys that container runtimes mask. If the\n       caller doesn\u0027t own the source mount namespace a non-recursive\n       copy of a mount with something mounted below the requested\n       directory is now refused and a recursive copy includes unbindable\n       mounts, the way unshare() copies.\n\n     * Keep the lock on a mount that a propagated copy is moved beneath.\n\n       MNT_LOCKED moved to any mount that ended up beneath a locked\n       mount, propagated copies included. A host mount and umount on a\n       directory covered by a locked mount in a less privileged mount\n       namespace left that cover unlocked for the namespace\u0027s owner to\n       remove. Only mounts the caller places beneath take over the lock\n       now.\n\n     * Handle mount locking for automounts correctly. Which copies to\n       lock was decided by the mount namespace of the task that\n       triggered the automount. A task in a user namespace that\n       triggered one on a host mount through a file descriptor got the\n       host\u0027s own automount locked while its own copy stayed unlocked\n       and could have nosuid, nodev and noexec cleared. Use the owner of\n       the mount namespace the mount lands in.\n\n   - Use-after-free and crashes:\n\n     * Refuse an automount below a mount that is in no namespace.\n\n       The private clones overlayfs uses for its layers have the\n       MNT_NS_INTERNAL error pointer as their namespace, which\n       finish_automount() let through and count_mounts() dereferenced. A\n       fanotify filesystem mark on an overlayfs lower layer hands out\n       file descriptors on such a clone. With debugfs as the lower layer\n       opening \"tracing\" oopses with namespace_sem held for writing and\n       every mount operation on the system blocks from then on.\n\n     * Reset the old parent\u0027s -\u003eovermount in mnt_change_mountpoint().\n       When propagate_umount() moved an overmount off a mount that a\n       file descriptor kept alive, MOVE_MOUNT_BENEATH through that\n       descriptor later followed the stale pointer into the freed\n       overmount.\n\n     * statmount() with STATMOUNT_BY_FD and pivot_root() read the parent\n       of a mount that may be unmounted and only held by a file\n       descriptor, while the parent\u0027s final mntput() can free it.\n       statmount() now reads it under mount_lock and pivot_root() first\n       checks that both mounts are in the caller\u0027s mount namespace.\n\n     * Queue a mount only once for mount notifications. A mount\n       reparented by one umount_tree() and taken down by the next under\n       the same namespace_sem hold, as in shrink_submounts(), was queued\n       twice. That cut the mounts queued in between out of notify_list\n       while it still pointed at them, and once they were freed every\n       later mount operation walked freed memory.\n\n     * Don\u0027t let a pseudo dentry become the root of a mount. A bind\n       mount of a bpf token file did that with a DCACHE_NORCU dentry,\n       which is freed without an RCU grace period while lockless path\n       walks may still look at it. Refuse to clone such a mount.\n\n     * Don\u0027t inherit MNT_UMOUNT in clone_mnt(). A bind mount of a lazily\n       unmounted nsfs or pidfs mount through its file descriptor started\n       out flagged as unmounted. Among other things __detach_mounts()\n       then dropped the namespace\u0027s reference on it, the mount outlived\n       its namespace and mount_setattr() through the descriptor read the\n       freed namespace. A recursive bind mount of such a mount also\n       copied the unmounted stack still attached to it. That now fails\n       with EINVAL, copying the mount itself still works.\n\n     * Remove the fsnotify marks of a mount namespace in free_mnt_ns()\n       instead of the RCU callback that frees the namespace, where\n       taking the group mutexes meant sleeping in softirq context.\n\n   - Propagation and copies:\n\n     * Keep a copied mount unbindable. Since v6.17 clone_mnt() didn\u0027t\n       copy the unbindable flag, so every mount namespace created with\n       CLONE_NEWNS had bindable copies of all unbindable mounts. This\n       had been fixed once before.\n\n     * Refuse MOVE_MOUNT_SET_GROUP on an unbindable mount. It made the\n       mount an unbindable slave, a state nothing else can produce, or\n       silently dropped the unbindable flag. CRIU applies MS_UNBINDABLE\n       after restoring sharing and isn\u0027t affected.\n\n     * Check a recursive bind mount for mount namespace loops.\n\n       Recursively bind mounting a tree from another mount namespace\n       could put a mount of a namespace\u0027s file inside that same\n       namespace, which then pins itself and all its mounts. Repeating\n       it leaks without limit, the reproducer took Shmem from 380 kB to\n       65916 kB. The copy is now checked with check_for_nsfs_mounts()\n       before it is grafted, as move_mount() does.\n\n     * Look at the topmost mount for a mount namespace file.\n\n       attach_recursive_mnt() never looked at the topmost mount of the\n       source\u0027s chain of overmounts. If that was the chain\u0027s only mount\n       namespace file an existing mount at a propagated destination got\n       buried below the root of the nsfs file where no path walk reaches\n       it.\n\n     * Don\u0027t put a mountpoint on a dentry that\u0027s being removed.\n\n       attach_recursive_mnt() makes a mountpoint of the source\u0027s root\n       without its inode lock, so a racing rmdir() of that directory\n       could leave a mount on it that nothing ever detaches.\n       d_set_mounted() now checks cant_mount() as well.\n\n   - nullfs:\n\n     * Take no inode lock for readdir of an immutable directory.\n\n       The root of every empty mount namespace is the same nullfs\n       directory and iterate_dir() held its i_rwsem across\n       -\u003eiterate_shared(). A reader whose buffer faults on a FUSE mount\n       of its own holds it for as long as its server wants, and with an\n       exclusive locker queued behind it every lookup that misses the\n       dcache, every create and every mount in that directory waits. One\n       user of an empty mount namespace stalls all others. Directories\n       with the new FOP_IMMUTABLE flag skip the lock.\n\n     * Refuse to reconfigure internal superblocks through fspick(),\n       MS_REMOUNT or the read-only remount that a synchronous umount()\n       of the root does. For nullfs only root in the initial user\n       namespace could do it, but the superblock is shared by every\n       mount namespace and the flags showed up in statfs() for all of\n       them.\n\n     * Don\u0027t update the access time on nullfs and refuse F_SET_RW_HINT\n       on an immutable inode.\n\n   - unshare: Free an nsproxy that was never installed with\n     nsproxy_free() when set_cred_ucounts() fails. put_nsproxy() dropped\n     active references that were never taken, which triggered a warning\n     and hid the caller\u0027s own namespaces from listns().\n\n   - Smaller changes: mount_setattr() checks the target before it walks\n     the tree to allocate peer group ids, unshare() puts the old\n     fs_struct before the old namespaces, dissolve_on_fput() drops the\n     file\u0027s reference to the tree itself, disconnect_mount() is\n     simplified and the documentation of the propagated unmount rule is\n     brought up to date\"\n\n* tag \u0027vfs-7.3-rc7.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (58 commits)\n  namespace: simplify disconnect_mount()\n  selftests/filesystems: test covered mounts\n  namespace: rework connected mounts\n  nullfs: add an empty immutable regular file\n  selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody\n  selftests/filesystems: add a helper that holds a readdir in a page fault\n  readdir: take no inode lock on an immutable directory\n  nullfs: refuse file locks\n  fsnotify: let a filesystem refuse marks on its objects\n  namespace: nothing is mounted on or written through knullfs\n  namespace: keep the private nullfs instance in knullfs\n  fhandle: decide the subtree check under mount_lock\n  selftests/filesystems: check that an automount below an overlay layer is refused\n  selftests/filesystems: check the atime of the empty mount namespace root\n  selftests/filesystems: check that a lock lands on the right mount and stays\n  namespace: keep the lock on a mount that a propagated copy is moved beneath\n  namespace: never expire a locked mount\n  nullfs: don\u0027t update the access time\n  namespace: handle mount locking for automounts correctly\n  namespace: refuse an automount below a mount that is in no namespace\n  ...\n",
  "tree_diff": []
}