Merge tag 'vfs-7.2-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

 - netfs:

    - fix the decision when to disallow write-streaming with fscache in
      use, handling of asynchronous cache object creation, a double fput
      in cachefiles, clearing S_KERNEL_FILE without the inode lock held,
      page extraction bugs in the iov_iter helpers (a potential
      underflow, a missing allocation failure check, a memory leak, and
      a folio offset miscalculation), writeback error and ENOMEM
      handling, DIO write retry for filesystems without a
      ->prepare_write() method, and the replacement of the wb_lock mutex
      with a bit lock plus writethrough collection offload so that
      multiple asynchronous writebacks don't interfere with each other.

    - Fix the barriering when walking the netfs subrequest list during
      retries as it was possible to see a subrequest that was just added
      by the application thread.

 - iomap:

    - Change iomap to submit read bios after each extent instead of
      building them up across extents. The old behavior was considered
      problematic for a while and now caused an actual erofs bug.

    - Guard the ioend io_size EOF trim in iomap against underflow when a
      concurrent truncate moves EOF below the start of the ioend,
      wrapping io_size to a huge value.

 - overlayfs

    - Fix a stale overlayfs comment about the locking order.

    - Store the linked-in upper dentry instead of the disconnected
      O_TMPFILE dentry during overlayfs tmpfile copy-up. With a FUSE or
      virtiofs upper layer ->d_revalidate() would try to look up "/" in
      the workdir and fail, causing persistent ESTALE errors that broke
      dpkg and apt.

 - vfs-bpf:

   Have the bpf_real_data_inode() kfunc take a struct file instead of a
   dentry so it is usable from the bprm_check_security, mmap_file, and
   file_mprotect hooks, and rename it from bpf_real_inode() to make the
   data-inode semantics explicit. The kfunc landed this cycle so the
   change is safe.

 - afs:

   NULL pointer dereferences in the callback service and in
   afs_get_tree(), several memory and refcount leaks, missing locking
   around the dynamic root inode numbers and premature cell exposure
   through /afs, a netns destruction hang caused by a misplaced
   increment of net->cells_outstanding, a bulk lookup malfunction caused
   by the dir_emit() API change, inode (re)initialisation issues, and
   assorted smaller fixes to error codes, seqlock handling, and debug
   output.

 - vfs:

   Refuse O_TMPFILE creation with an unmapped fsuid or fsgid and add a
   selftest for it.

 - vboxsf:

   Add Jori Koolstra as vboxsf maintainer, taking over from Hans de
   Goede.

 - dio:

   Release the pages attached to a short atomic dio bio; the REQ_ATOMIC
   size check error path leaked them.

 - procfs:

   Only bump the parent directory link count when registering
   directories in procfs. Registering regular files inflated the count
   and leaked a link on every create and remove cycle.

 - minix:

   Avoid an unsigned overflow in the minix bitmap block count
   calculation that let crafted images with huge inode or zone counts
   pass superblock validation and crash the kernel during mount.

 - cachefiles:

   Fix a double unlock in the cachefiles nomem_d_alloc error path left
   over from the start_creating() conversion.

 - fat:

   Stop fat from reading directory entries past the 0x00
   end-of-directory marker. If the trailing on-disk slots aren't
   zero-filled the driver surfaced arbitrary garbage as directory
   entries.

 - freexvfs:

   Don't BUG() on unknown typed-extent types in freevxfs, reachable via
   ioctl(FIBMAP) on a crafted image; fail with an I/O error instead.

 - orangefs:

   Keep the readdir entry size 64-bit in orangefs fill_from_part().
   Truncating it to __u32 bypassed the bounds check and led to
   out-of-bounds reads triggerable by the userspace client.

 - xfs:

   Fix the error unwind in xfs_open_devices() which released the rt
   device file twice and left dangling buftarg pointers behind that were
   freed again when the failed mount was torn down.

 - exec:

   Fix an off-by-one in the comment documenting the maximum binfmt
   rewrite depth in exec_binprm(). The code allows five rewrites, not
   four; restricting the code would break userspace so the comment is
   fixed instead.

 - file handles:

   Reject detached mounts in capable_wrt_mount(). A detached mount can
   be dissolved concurrently, leaving a NULL mount namespace that
   open_by_handle_at() would dereference.

* tag 'vfs-7.2-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (57 commits)
  netfs: Fix barriering when walking subrequest list
  iomap: submit read bio after each extent
  fuse: call fuse_send_readpages explicitly from fuse_readahead
  iomap: consolidate bio submission
  fhandle: reject detached mounts in capable_wrt_mount()
  netfs: Fix DIO write retry for filesystems without a ->prepare_write()
  netfs: Fix folio state after ENOMEM whilst under writeback iteration
  netfs: Fix writeback error handling
  netfs: Fix writethrough to use collection offload
  netfs: Replace wb_lock with a bit lock for asynchronicity
  netfs: Fix kdoc warning
  scatterlist: Fix offset in folio calc in extract_xarray_to_sg()
  iov_iter: Remove unused variable in kunit_iov_iter.c
  iov_iter: Fix a memory leak in iov_iter_extract_user_pages()
  iov_iter: Fix missing alloc fail check in iov_iter_extract_bvec_pages()
  iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages()
  cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE
  cachefiles: Fix double fput
  netfs: Fix netfs_create_write_req() to handle async cache object creation
  netfs: Fix decision whether to disallow write-streaming due to fscache use
  ...

diff --combined MAINTAINERS
index 25453040dffbc954c2728e0ac438cdae2fb3f789,a6f463d20328b2457565007947a644913b96a56d..7cc4bca5a2c5594516ba7e15d3eb9e29b026eade
--- 1/MAINTAINERS
--- 2/MAINTAINERS
+++ b/MAINTAINERS
@@@ -15738,8 -15738,8 +15738,8 @@@ F:   drivers/net/ethernet/marvell/octeon_
  MARVELL OCTEONTX2 PHYSICAL FUNCTION DRIVER
  M:    Sunil Goutham <sgoutham@marvell.com>
  M:    Geetha sowjanya <gakula@marvell.com>
 +M:    Ratheesh Kannoth <rkannoth@marvell.com>
  M:    Subbaraya Sundeep <sbhatta@marvell.com>
 -M:    hariprasad <hkelam@marvell.com>
  M:    Bharat Bhushan <bbhushan2@marvell.com>
  L:    netdev@vger.kernel.org
  S:    Maintained
@@@ -15748,8 -15748,9 +15748,8 @@@ F:   include/linux/soc/marvell/octeontx2
  
  MARVELL OCTEONTX2 RVU ADMIN FUNCTION DRIVER
  M:    Sunil Goutham <sgoutham@marvell.com>
 -M:    Linu Cherian <lcherian@marvell.com>
 +M:    Ratheesh Kannoth <rkannoth@marvell.com>
  M:    Geetha sowjanya <gakula@marvell.com>
 -M:    hariprasad <hkelam@marvell.com>
  M:    Subbaraya Sundeep <sbhatta@marvell.com>
  L:    netdev@vger.kernel.org
  S:    Maintained
@@@ -15757,8 -15758,8 +15757,8 @@@ F:   Documentation/networking/device_driv
  F:    drivers/net/ethernet/marvell/octeontx2/af/
  
  MARVELL PEM PMU DRIVER
 -M:    Linu Cherian <lcherian@marvell.com>
  M:    Gowthami Thiagarajan <gthiagarajan@marvell.com>
 +M:    Geetha sowjanya <gakula@marvell.com>
  S:    Supported
  F:    drivers/perf/marvell_pem_pmu.c
  
@@@ -18441,7 -18442,6 +18441,7 @@@ F:   drivers/net/ethernet/mucse
  
  MULTIFUNCTION DEVICES (MFD)
  M:    Lee Jones <lee@kernel.org>
 +L:    mfd@lists.linux.dev
  S:    Maintained
  T:    git git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd.git
  F:    Documentation/devicetree/bindings/mfd/
@@@ -27520,7 -27520,7 +27520,7 @@@ F:   drivers/net/ethernet/dec/tulip
  
  TUN/TAP DRIVER
  M:    Willem de Bruijn <willemdebruijn.kernel@gmail.com>
 -M:    Jason Wang <jasowang@redhat.com>
 +M:    Jason Wang <jasowangio@gmail.com>
  S:    Maintained
  W:    http://vtun.sourceforge.net/tun
  F:    Documentation/networking/tuntap.rst
@@@ -28512,7 -28512,7 +28512,7 @@@ F:   include/uapi/linux/virtio_balloon.
  
  VIRTIO BLOCK AND SCSI DRIVERS
  M:    "Michael S. Tsirkin" <mst@redhat.com>
 -M:    Jason Wang <jasowang@redhat.com>
 +M:    Jason Wang <jasowangio@gmail.com>
  R:    Paolo Bonzini <pbonzini@redhat.com>
  R:    Stefan Hajnoczi <stefanha@redhat.com>
  R:    Eugenio Pérez <eperezma@redhat.com>
@@@ -28541,7 -28541,7 +28541,7 @@@ F:   include/uapi/linux/virtio_console.
  
  VIRTIO CORE
  M:    "Michael S. Tsirkin" <mst@redhat.com>
 -M:    Jason Wang <jasowang@redhat.com>
 +M:    Jason Wang <jasowangio@gmail.com>
  R:    Xuan Zhuo <xuanzhuo@linux.alibaba.com>
  R:    Eugenio Pérez <eperezma@redhat.com>
  L:    virtualization@lists.linux.dev
@@@ -28619,7 -28619,7 +28619,7 @@@ F:   include/uapi/linux/virtio_gpu.
  
  VIRTIO HOST (VHOST)
  M:    "Michael S. Tsirkin" <mst@redhat.com>
 -M:    Jason Wang <jasowang@redhat.com>
 +M:    Jason Wang <jasowangio@gmail.com>
  R:    Eugenio Pérez <eperezma@redhat.com>
  L:    kvm@vger.kernel.org
  L:    virtualization@lists.linux.dev
@@@ -28634,7 -28634,7 +28634,7 @@@ F:   kernel/vhost_task.
  
  VIRTIO HOST (VHOST-SCSI)
  M:    "Michael S. Tsirkin" <mst@redhat.com>
 -M:    Jason Wang <jasowang@redhat.com>
 +M:    Jason Wang <jasowangio@gmail.com>
  M:    Mike Christie <michael.christie@oracle.com>
  R:    Paolo Bonzini <pbonzini@redhat.com>
  R:    Stefan Hajnoczi <stefanha@redhat.com>
@@@ -28674,7 -28674,7 +28674,7 @@@ F:   include/uapi/linux/virtio_mem.
  
  VIRTIO NET DRIVER
  M:    "Michael S. Tsirkin" <mst@redhat.com>
 -M:    Jason Wang <jasowang@redhat.com>
 +M:    Jason Wang <jasowangio@gmail.com>
  R:    Xuan Zhuo <xuanzhuo@linux.alibaba.com>
  R:    Eugenio Pérez <eperezma@redhat.com>
  L:    netdev@vger.kernel.org
@@@ -28725,7 -28725,7 +28725,7 @@@ F:   include/linux/vbox_utils.
  F:    include/uapi/linux/vbox*.h
  
  VIRTUAL BOX SHARED FOLDER VFS DRIVER
- M:    Hans de Goede <hansg@kernel.org>
+ M:    Jori Koolstra <jkoolstra@xs4all.nl>
  L:    linux-fsdevel@vger.kernel.org
  S:    Maintained
  F:    fs/vboxsf/*