--- /dev/null
+From cd001423637cd2d227d93ba317caa0eb82172005 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Aug 2026 13:38:27 +0300
+Subject: mount: honour SB_NOUSER in the new mount API
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ]
+
+One should *not* be allowed to mount one of those, new API or not.
+
+Reported-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+[Denis: rename new_mnt -> newmount.mnt]
+[Denis: use goto err_unlock instead of direct return]
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index e9b8d516f1919..fcb9ab4617754 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -3657,6 +3657,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
+ ret = PTR_ERR(newmount.mnt);
+ goto err_unlock;
+ }
++ if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) {
++ mntput(newmount.mnt);
++ ret = -EINVAL;
++ goto err_unlock;
++ }
+ newmount.dentry = dget(fc->root);
+ newmount.mnt->mnt_flags = mnt_flags;
+
+--
+2.53.0
+
--- /dev/null
+mount-honour-sb_nouser-in-the-new-mount-api.patch
--- /dev/null
+From 76843dde657d29ba78b01afd0d982f3a5fc4a74b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Aug 2026 13:38:27 +0300
+Subject: mount: honour SB_NOUSER in the new mount API
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ]
+
+One should *not* be allowed to mount one of those, new API or not.
+
+Reported-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+[Denis: rename new_mnt -> newmount.mnt]
+[Denis: use goto err_unlock instead of direct return]
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index ae1b8530eb939..2c502d554f619 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -3700,6 +3700,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
+ ret = PTR_ERR(newmount.mnt);
+ goto err_unlock;
+ }
++ if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) {
++ mntput(newmount.mnt);
++ ret = -EINVAL;
++ goto err_unlock;
++ }
+ newmount.dentry = dget(fc->root);
+ newmount.mnt->mnt_flags = mnt_flags;
+
+--
+2.53.0
+
--- /dev/null
+mount-honour-sb_nouser-in-the-new-mount-api.patch
--- /dev/null
+From 457b874bd86a38c389a283e1fd30ea69389fbf1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Aug 2026 13:38:27 +0300
+Subject: mount: honour SB_NOUSER in the new mount API
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ]
+
+One should *not* be allowed to mount one of those, new API or not.
+
+Reported-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+[Denis: rename new_mnt -> newmount.mnt]
+[Denis: use goto err_unlock instead of direct return]
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index f22f76d9c22f9..ed5e9e7251e34 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -3744,6 +3744,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
+ ret = PTR_ERR(newmount.mnt);
+ goto err_unlock;
+ }
++ if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) {
++ mntput(newmount.mnt);
++ ret = -EINVAL;
++ goto err_unlock;
++ }
+ newmount.dentry = dget(fc->root);
+ newmount.mnt->mnt_flags = mnt_flags;
+
+--
+2.53.0
+
--- /dev/null
+mount-honour-sb_nouser-in-the-new-mount-api.patch
--- /dev/null
+From 7c999d589feb5d12b33331c2fe620699645b0c4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Aug 2026 13:38:27 +0300
+Subject: mount: honour SB_NOUSER in the new mount API
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ]
+
+One should *not* be allowed to mount one of those, new API or not.
+
+Reported-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+[Denis: rename new_mnt -> newmount.mnt]
+[Denis: use goto err_unlock instead of direct return]
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 94c06c8429023..a596381dba1c4 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -4229,6 +4229,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
+ ret = PTR_ERR(newmount.mnt);
+ goto err_unlock;
+ }
++ if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) {
++ mntput(newmount.mnt);
++ ret = -EINVAL;
++ goto err_unlock;
++ }
+ newmount.dentry = dget(fc->root);
+ newmount.mnt->mnt_flags = mnt_flags;
+
+--
+2.53.0
+
--- /dev/null
+mount-honour-sb_nouser-in-the-new-mount-api.patch
--- /dev/null
+From 7486fdbe2f4bed9ad33aea4483e7fe620c121ee6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Aug 2026 12:22:18 -0700
+Subject: KVM: s390: pci: Fix resource leak on IRQ registration failure
+
+From: Farhan Ali <alifm@linux.ibm.com>
+
+[ Upstream commit 5580c9858f1e00f60191eb09c3add359836d60b6 ]
+
+Currently if kvm_zpci_set_airq() fails, kvm_s390_pci_aif_enable() returns
+the error code but doesn't do any resource cleanup thus leaking resources.
+Fix this by cleaning up all the resources such as the GAITE, AIBV, AISB and
+unpinning any pinned pages. While at it, remove dead code that stored FIB
+values that were never referenced.
+
+As part of the cleanup, we are also holding the aift_lock a bit longer, as
+we hold the lock while executing the MPCIFC instruction. Though this is not
+strictly necessary, it means we don't have to drop and re-acquire in the
+error case.
+
+Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
+Cc: stable@vger.kernel.org
+Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
+Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
+Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
+Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/pci.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c
+index 4cc554c9d3283..b729457d30167 100644
+--- a/arch/s390/kvm/pci.c
++++ b/arch/s390/kvm/pci.c
+@@ -359,19 +359,32 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
+ aift->kzdev[zdev->aisb] = zdev->kzdev;
+ spin_unlock_irq(&aift->gait_lock);
+
+- /* Update guest FIB for re-issue */
+- fib->fmt0.aisbo = zdev->aisb & 63;
+- fib->fmt0.aisb = virt_to_phys(aift->sbv->vector + (zdev->aisb / 64) * 8);
+- fib->fmt0.isc = gisc;
+-
+ /* Save some guest fib values in the host for later use */
+- zdev->kzdev->fib.fmt0.isc = fib->fmt0.isc;
++ zdev->kzdev->fib.fmt0.isc = gisc;
+ zdev->kzdev->fib.fmt0.aibv = fib->fmt0.aibv;
+- mutex_unlock(&aift->aift_lock);
+
+ /* Issue the clp to setup the irq now */
+ rc = kvm_zpci_set_airq(zdev);
+- return rc;
++ if (!rc) {
++ mutex_unlock(&aift->aift_lock);
++ return rc;
++ }
++
++ /* Start cleanup */
++ zdev->kzdev->fib.fmt0.isc = 0;
++ zdev->kzdev->fib.fmt0.aibv = 0;
++
++ spin_lock_irq(&aift->gait_lock);
++ gaite->count--;
++ gaite->aisb = 0;
++ gaite->gisc = 0;
++ gaite->aisbo = 0;
++ gaite->gisa = 0;
++ aift->kzdev[zdev->aisb] = NULL;
++ spin_unlock_irq(&aift->gait_lock);
++
++ airq_iv_release(zdev->aibv);
++ zdev->aibv = NULL;
+
+ free_aisb:
+ airq_iv_free_bit(aift->sbv, zdev->aisb);
+--
+2.53.0
+
--- /dev/null
+From 742060c87b6278128efd3f94926fecabcea23b6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Aug 2026 13:38:27 +0300
+Subject: mount: honour SB_NOUSER in the new mount API
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ]
+
+One should *not* be allowed to mount one of those, new API or not.
+
+Reported-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+[Denis: rename new_mnt -> newmount.mnt]
+[Denis: use goto err_unlock instead of direct return]
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 5fd8b021785a4..d886ae255e40a 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -4352,6 +4352,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
+ ret = PTR_ERR(newmount.mnt);
+ goto err_unlock;
+ }
++ if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) {
++ mntput(newmount.mnt);
++ ret = -EINVAL;
++ goto err_unlock;
++ }
+ newmount.dentry = dget(fc->root);
+ newmount.mnt->mnt_flags = mnt_flags;
+
+--
+2.53.0
+
--- /dev/null
+kvm-s390-pci-fix-resource-leak-on-irq-registration-f.patch
+mount-honour-sb_nouser-in-the-new-mount-api.patch
--- /dev/null
+From 705e43b73bf638051584ee90764480401a254162 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Aug 2026 13:38:27 +0300
+Subject: mount: honour SB_NOUSER in the new mount API
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ]
+
+One should *not* be allowed to mount one of those, new API or not.
+
+Reported-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+[Denis: rename new_mnt -> newmount.mnt]
+[Denis: use goto err_unlock instead of direct return]
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 646d9e7d41ee8..f185de5f5df4a 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -4050,6 +4050,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
+ ret = PTR_ERR(newmount.mnt);
+ goto err_unlock;
+ }
++ if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) {
++ mntput(newmount.mnt);
++ ret = -EINVAL;
++ goto err_unlock;
++ }
+ newmount.dentry = dget(fc->root);
+ newmount.mnt->mnt_flags = mnt_flags;
+
+--
+2.53.0
+
--- /dev/null
+mount-honour-sb_nouser-in-the-new-mount-api.patch
--- /dev/null
+From 867a4cb6b92b5e4a5e7d05c6f019d1ef92320391 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jun 2026 03:04:44 +0100
+Subject: mount: honour SB_NOUSER in the new mount API
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ]
+
+One should *not* be allowed to mount one of those, new API or not.
+
+Reported-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 341ddd353b3a8..841ef26127861 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -4502,6 +4502,10 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
+ new_mnt = vfs_create_mount(fc);
+ if (IS_ERR(new_mnt))
+ return PTR_ERR(new_mnt);
++ if (new_mnt->mnt_sb->s_flags & SB_NOUSER) {
++ mntput(new_mnt);
++ return -EINVAL;
++ }
+ new_mnt->mnt_flags = mnt_flags;
+
+ new_path.dentry = dget(fc->root);
+--
+2.53.0
+
--- /dev/null
+mount-honour-sb_nouser-in-the-new-mount-api.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
