From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sun, 14 Jun 2026 22:58:20 +0000 (+0530)
Subject: Merge tag 'pull-configfs-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git... 
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=de02909ae81aa4fda213d16915adb5e1b088a7db;p=thirdparty%2Fkernel%2Flinux.git

Merge tag 'pull-configfs-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull configfs updates from Al Viro:
 "A couple of fixes (UAF in configfs_lookup() and really old races
  introduced when lseek() on configfs directories stopped locking those
  directories; impact up to and including UAF).

  Fixes aside, the main result is that configfs is finally switched to
  tree-in-dcache machinery. It's *not* making use of recursive removal
  helpers yet, and it still does the bloody awful "build subtree in full
  sight of userland, with possibility of failure halfway through and
  need to unroll" that forces the locking model from hell; dealing with
  that is a separate patch series, once this one is out of the way.
  However, it is using DCACHE_PERSISTENT properly now. And apparmorfs is
  the sole remaining user of __simple_{unlink,rmdir}() at that point"

* tag 'pull-configfs-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  create_default_group(): pass parent's dentry instead of config_group
  configfs_attach_group(): drop the unused parent_item argument
  configs_attach_item(): drop unused parent_item argument
  configfs_create(): lift parent timestamp updates into callers
  kill configfs_drop_dentry()
  configfs: mark pinned dentries persistent
  configfs: dentry refcount needs to be pinned only once
  switch configfs_detach_{group,item}() to passing dentry
  configfs_remove_dir(), detach_attrs(): switch to passing dentry
  populate_attrs(): move cleanup to the sole caller
  populate_group(): move cleanup on failure to the sole caller
  configfs_detach_rollback(): pass configfs_dirent instead of dentry
  configfs_do_depend_item(): pass configfs_dirent instead of dentry
  configfs_depend_prep(): pass configfs_dirent instead of dentry
  configfs_detach_prep(): pass configfs_dirent instead of dentry
  configfs_mkdir(): use take_dentry_name_snapshot()
  configfs: fix lockless traversals of ->s_children
  configfs_lookup(): don't leave ->s_dentry dangling on failure
---

de02909ae81aa4fda213d16915adb5e1b088a7db