kernel/git/stable/linux.git/fs/namei.c, branch master

Merge tag 'vfs-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-08-17T19:56:12+00:00

Pull misc vfs updates from Christian Brauner: "Bigger cleanups: - The lockref dead-count handling is tidied up. The open-coded check for a count below zero as the dead marker relies on information the caller should not have. - make put_mnt_ns() leave mounts connected. Destroying a mount namespace disconnected its mounts from their mount points. So a file descriptor still open on the parent of a mount point could be used to peek under it. Locked mounts were already kept connected to prevent exactly that. But a mount is only locked when its tree is copied across a user namespace boundary. So a mount namespace set up by a privileged component had no locked mounts and its mounts were disconnected. Passing UMOUNT_CONNECTED keeps every mount connected and prevents that bug. - vfs_prepare_mode() passes S_IFDIR for directories. I meant to fix that ago but didn't get to it. So now someone finally did it. This kills the exception where the mode could be 0 when a directory was created whereas every other creation operation passed it explicitly already. - move long delayed work for ufs, jffs2, hfsplus, hfs and affs from the per-cpu system_long_wq to the new unbound system_dfl_long_wq. None of that work relies on per-cpu state and the work item is enqueued with queue_delayed_work() whose timer is global anyway. So it may as well benefit from scheduler task placement. Smaller fixes and cleanups: - unlock_buffer() and journal_end_buffer_io_sync() use clear_and_wake_up_bit() - the pipe page pools are unified into a single per-pipe pool and the extra wake_up(rd_wait) is limited to EPOLLET consumers - eventpoll now computes its timer slack lazily in ep_poll() - shrink_dcache_for_umount() keeps making progress on busy roots - excess xarray nodes are freed in clear_inode() - romfs detects hard link cycles - the user path of nested backing files is fixed - pidfd holds exec_update_lock around the namespace ioctl - non-memcg-aware nr_cached_objects is skipped during memcg slab shrink - iomap_write_iter() always returns status - mangle_path() is renamed to seq_mangle_path() - inode timestamp accessors are annotated - new regression test for pipe->poll_usage. - a few documentation, kernel-doc and selftest fixes" * tag 'vfs-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (67 commits) selftests/namespaces: Fix racy pipe handshake in timens and pidns_separate selftests/epoll: add a regression test for pipe->poll_usage pipe: only enable the extra wake_up(rd_wait) for EPOLLET consumers pidfd: hold exec_update_lock around namespace ioctl fs: fix user path of nested backing files fs: remove stale inode_insert5() kernel-doc parameter fs: fix switch/case indentation in sysfs() syscall fs: document semantics of kstat::{uid,gid} fields dcache: keep shrink_dcache_for_umount() making progress on busy roots seq_file: rename mangle_path to seq_mangle_path nstree: add/fix struct ns_id_req kernel-doc member fields dcache: use lockref routines for dead count checks lockref: tidy up dead count handling initramfs: fix typo in reserve_initrd_mem comment fs/pipe: unify the page pools into a single per-pipe pool fs: annotate inode timestamp accessors eventpoll: compute timer slack lazily in ep_poll() selftests/filesystems: add mntns cleanup test put_mnt_ns(): leave mounts connected affs: Move long delayed work on system_dfl_long_wq ...

Merge tag 'vfs-7.3-rc1.lookup' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-08-17T19:03:34+00:00

Pull vfs lookup updates from Christian Brauner: "This refactors lookup_open() and adds vfs_lookup_open() for nfsd. mnt_want_write() and parent locking are moved into lookup_open() itself. audit_inode_child() is also now called in lookup_open() on failure. That is the calling convention in vfs_create() and vfs_mkdir(), but lookup_open() made no such call when atomic_open() should have created a file and did not. And neither did the regular ->create() path fwiw. This also contains work to remove the unneeded excl argument from the ->create() inode op" * tag 'vfs-7.3-rc1.lookup' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs/namei.c: fix coding style in atomic_open() and lookup_open() fs/namei.c: fix kerneldoc of atomic_open() and vfs_lookup_open() fs/namei.c: update stale comments in lookup_open() Remove excl arg to ->create inode_operation fs/namei.c: update kerneldoc of atomic_open() vfs: call audit_inode_child() in lookup_open() on failure vfs: move create error && negative dentry case in lookup_open() up VFS: add vfs_lookup_open() for nfsd VFS: move delegated_inode retry loop into lookup_open() VFS: move mnt_want_write() and locking into lookup_open()

fs/namei.c: fix coding style in atomic_open() and lookup_open()

2026-07-31T08:37:40+00:00

Commit 4886c80eef20 ("vfs: call audit_inode_child() in lookup_open() on failure") indented a continuation line with spaces, left three declarations without a following blank line and used a trailing */ on the last line of a block comment. Clean all of that up, no functional change. Link: https://patch.msgid.link/20260731-work-lookup-fixes-v1-3-2412b85cf65c@kernel.org Fixes: 4886c80eef20 ("vfs: call audit_inode_child() in lookup_open() on failure") Signed-off-by: Christian Brauner (Amutable)

fs/namei.c: fix kerneldoc of atomic_open() and vfs_lookup_open()

2026-07-31T08:37:40+00:00

Commit ba0e87026613 ("fs/namei.c: update kerneldoc of atomic_open()") turned the comment above atomic_open() into kerneldoc, but wrote the return description as running text. kernel-doc only recognises a return section introduced by "Return:" or "Returns:", so this added a warning under W=1: fs/namei.c:4362 No description found for return value of 'atomic_open' Give it the missing colon. The summary line also has to stand on its own line, so move the "from a negative dentry" part into the body, where it can say that the caller has to hand over a negative dentry. Also add the "to" missing from vfs_lookup_open()'s description. Link: https://patch.msgid.link/20260731-work-lookup-fixes-v1-2-2412b85cf65c@kernel.org Fixes: ba0e87026613 ("fs/namei.c: update kerneldoc of atomic_open()") Fixes: 536227b814bd ("VFS: add vfs_lookup_open() for nfsd") Signed-off-by: Christian Brauner (Amutable)

fs/namei.c: update stale comments in lookup_open()

2026-07-31T08:37:40+00:00

Commit ddb6e6c72a0a ("VFS: move mnt_want_write() and locking into lookup_open()") moved the parent inode locking into lookup_open(), but left the comment claiming the caller has to take it. A caller following that comment now deadlocks, and the series added a second caller. Describe what the function actually does. While at it drop the claim that it returns 0 on success and updates @path, wrong ever since lookup_open() started returning a dentry in v5.7, and fix the reference to lookup_open() in a comment that now sits inside lookup_open() itself. Link: https://patch.msgid.link/20260731-work-lookup-fixes-v1-1-2412b85cf65c@kernel.org Fixes: ddb6e6c72a0a ("VFS: move mnt_want_write() and locking into lookup_open()") Signed-off-by: Christian Brauner (Amutable)

Remove excl arg to ->create inode_operation

2026-07-31T08:18:30+00:00

The only time that 'false' is passed as the 'excl' arg to the ->create inode_operation is in lookup_open() when ->atomic_open is not provided by the parent directory. *all* directory inode_operations which do not have ->atomic_open completely ignore the 'excl' arg. Therefore we don't need the 'excl' arg. Those few ->create operations which pay attention to the arg are only ever called with a value of 'true'. We remove that arg and change all ->create operations to behave as those thhe arg were 'true'. Signed-off-by: NeilBrown Link: https://patch.msgid.link/178290671516.27465.15984496764174914338@noble.neil.brown.name Reviewed-by: Jori Koolstra Reviewed-by: Jan Kara Signed-off-by: Christian Brauner (Amutable)

fs/namei.c: update kerneldoc of atomic_open()

2026-07-30T10:16:56+00:00

The comments above atomic_open() contain several errors: - atomic_open() does not return 0 if successful - @path is not updated Fix those and be more explicit about when FMODE_OPENED and FMODE_CREATED are set. Change to a full kerneldoc. Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20260710164233.827744-4-jkoolstra@xs4all.nl Reviewed-by: Paul Moore Signed-off-by: Christian Brauner (Amutable)

vfs: call audit_inode_child() in lookup_open() on failure

2026-07-30T10:16:56+00:00

audit_inode_child() is called in may_create_dentry() so that failed filesystem operations still register an audit entry. On success, the entry is overwritten when, for instance, fsnotify_create() is called. This is the calling convention in vfs_create() and vfs_mkdir(). In lookup_open(), however, when atomic_open() should have created a file but didn't, no call to audit_inode_child() is made. The same is true for the regular ->create() path. Fix the calling of audit_inode_child() in lookup_open() to match the vfs_create() path. For the ->atomic_open() filesystems this logic has been pushed into atomic_open(). This function is also reordered a bit to make the case distinction of the possible returns from ->atomic_open() more explicit (i.e. finish_open() or finish_no_open()). When retrying delegation breaking, audit_inode_child() could be called more than once, but this is OK because those entries are reused. Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20260710164233.827744-3-jkoolstra@xs4all.nl Acked-by: Paul Moore (audit) Signed-off-by: Christian Brauner (Amutable)

vfs: move create error && negative dentry case in lookup_open() up

2026-07-30T10:16:55+00:00

O_CREAT is stripped when create_error is set in lookup_open(), so when lookup does not return an inode, the case if (!dentry->d_inode && (open_flag & O_CREAT)) is always skipped. We can get rid of this cognitive step by handling the error case first. Reviewed-by: NeilBrown Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20260710164233.827744-2-jkoolstra@xs4all.nl Signed-off-by: Christian Brauner (Amutable)

VFS: add vfs_lookup_open() for nfsd

2026-07-23T13:42:48+00:00

vfs_lookup_open() is a limited version of lookup_open() which is exported for nfsd to use - to replace dentry_create(). It is limited in that no filename is given (thus no auditing) and no LOOKUP_ flags are passed. A few "intent" LOOKUP flags are deduced from the open flags. If a non-regular file is found and appropriate error is returned and no file is opened. Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260714230534.776886-4-neilb@ownmail.net Reviewed-by: Jori Koolstra Signed-off-by: Christian Brauner (Amutable)