From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Tue, 10 Feb 2026 00:58:28 +0000 (-0800)
Subject: Merge tag 'pull-filename' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=26c9342bb761e463774a64fb6210b4f95f5bc035;p=thirdparty%2Flinux.git

Merge tag 'pull-filename' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs 'struct filename' updates from Al Viro:
 "[Mostly] sanitize struct filename handling"

* tag 'pull-filename' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (68 commits)
  sysfs(2): fs_index() argument is _not_ a pathname
  alpha: switch osf_mount() to strndup_user()
  ksmbd: use CLASS(filename_kernel)
  mqueue: switch to CLASS(filename)
  user_statfs(): switch to CLASS(filename)
  statx: switch to CLASS(filename_maybe_null)
  quotactl_block(): switch to CLASS(filename)
  chroot(2): switch to CLASS(filename)
  move_mount(2): switch to CLASS(filename_maybe_null)
  namei.c: switch user pathname imports to CLASS(filename{,_flags})
  namei.c: convert getname_kernel() callers to CLASS(filename_kernel)
  do_f{chmod,chown,access}at(): use CLASS(filename_uflags)
  do_readlinkat(): switch to CLASS(filename_flags)
  do_sys_truncate(): switch to CLASS(filename)
  do_utimes_path(): switch to CLASS(filename_uflags)
  chdir(2): unspaghettify a bit...
  do_fchownat(): unspaghettify a bit...
  fspick(2): use CLASS(filename_flags)
  name_to_handle_at(): use CLASS(filename_uflags)
  vfs_open_tree(): use CLASS(filename_uflags)
  ...
---

26c9342bb761e463774a64fb6210b4f95f5bc035
diff --cc Documentation/filesystems/porting.rst
index ed3ac56e3c768,909c7d0232f97..79e2c30082891
--- a/Documentation/filesystems/porting.rst
+++ b/Documentation/filesystems/porting.rst
@@@ -1336,7 -1339,9 +1336,18 @@@ in-tree filesystems have done)
  
  **mandatory**
  
 +The ->setlease() file_operation must now be explicitly set in order to provide
 +support for leases. When set to NULL, the kernel will now return -EINVAL to
 +attempts to set a lease. Filesystems that wish to use the kernel-internal lease
 +implementation should set it to generic_setlease().
++
++---
++
++**mandatory**
++
+ fs/namei.c primitives that consume filesystem references (do_renameat2(),
+ do_linkat(), do_symlinkat(), do_mkdirat(), do_mknodat(), do_unlinkat()
+ and do_rmdir()) are gone; they are replaced with non-consuming analogues
+ (filename_renameat2(), etc.)
+ Callers are adjusted - responsibility for dropping the filenames belongs
+ to them now.
diff --cc fs/namespace.c
index 0cc8c2757500a,612757bd166a2..a67cbe42746d5
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@@ -3195,22 -3082,12 +3195,21 @@@ static struct file *vfs_open_tree(int d
  		lookup_flags &= ~LOOKUP_AUTOMOUNT;
  	if (flags & AT_SYMLINK_NOFOLLOW)
  		lookup_flags &= ~LOOKUP_FOLLOW;
- 	if (flags & AT_EMPTY_PATH)
- 		lookup_flags |= LOOKUP_EMPTY;
  
 -	if (detached && !may_mount())
 +	/*
 +	 * If we create a new mount namespace with the cloned mount tree we
 +	 * just care about being privileged over our current user namespace.
 +	 * The new mount namespace will be owned by it.
 +	 */
 +	if ((flags & OPEN_TREE_NAMESPACE) &&
 +	    !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
 +		return ERR_PTR(-EPERM);
 +
 +	if ((flags & OPEN_TREE_CLONE) && !may_mount())
  		return ERR_PTR(-EPERM);
  
- 	ret = user_path_at(dfd, filename, lookup_flags, &path);
+ 	CLASS(filename_uflags, name)(filename, flags);
+ 	ret = filename_lookup(dfd, name, lookup_flags, &path, NULL);
  	if (unlikely(ret))
  		return ERR_PTR(ret);