Jann Horn 805d5a2b79 namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories ... open_tree(..., OPEN_TREE_NAMESPACE) and fsmount(..., FSMOUNT_NAMESPACE, ...) currently work on non-directories, like regular files. That's bad for two reasons: - It ends up mounting a regular file over the inherited namespace root, which is a directory; mounting a non-directory over a directory is normally explicitly forbidden, see for example do_move_mount() - It causes setns() on the new namespace to set the cwd to a regular file, which the rest of VFS does not expect Fix it by restricting create_new_namespace() (which is used by both of these flags) to directories. Leave the behavior for OPEN_TREE_CLONE as-is, that seems unproblematic. Fixes: 9b8a0ba682 ("mount: add OPEN_TREE_NAMESPACE") Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Christian Brauner <brauner@kernel.org> Cc: Jan Kara <jack@suse.cz> Cc: stable@kernel.org Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2026-06-10 07:09:20 -07:00
..
9p	netfs: Fix potential for tearing in ->remote_i_size and ->zero_point	2026-05-12 14:42:30 +02:00
adfs	ARM development for 7.1-rc1	2026-04-25 07:44:26 -07:00
affs	Fixing livelocks in shrink_dcache_tree()	2026-04-21 07:30:44 -07:00
afs	afs: Fix the locking used by afs_get_link()	2026-05-12 14:42:33 +02:00
autofs
befs
bfs
btrfs	for-7.1-rc4-tag	2026-05-23 16:54:48 -07:00
cachefiles	cachefiles: Fix error return when vfs_mkdir() fails	2026-05-15 15:32:43 +02:00
ceph	ceph: put folios not suitable for writeback	2026-05-11 10:39:22 +02:00
coda	coda cleanups and fixes	2026-04-21 14:03:10 -07:00
configfs
cramfs
crypto	fscrypt updates for 7.1	2026-04-13 17:29:12 -07:00
debugfs
devpts
dlm
ecryptfs	eCryptfs changes for 7.1-rc1	2026-04-20 10:54:17 -07:00
efivarfs	efivarfs: use QSTR() in efivarfs_alloc_dentry	2026-04-28 12:30:59 +02:00
efs
erofs	erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check()	2026-06-02 01:52:58 +08:00
exfat	Description for this pull request:	2026-04-13 16:57:31 -07:00
exportfs	Fixing livelocks in shrink_dcache_tree()	2026-04-21 07:30:44 -07:00
ext2	\n	2026-04-15 19:22:16 -07:00
ext4	Various clean ups and bug fixes in ext4 for 7.1:	2026-04-17 17:08:31 -07:00
f2fs	f2fs-for-7.1-rc1	2026-04-21 14:50:04 -07:00
fat
freevxfs
fuse	fuse: reject fuse_notify() pagecache ops on directories	2026-05-22 15:19:26 +02:00
gfs2	gfs2 changes	2026-04-15 19:12:04 -07:00
hfs
hfsplus	hfs/hfsplus updates for v7.1	2026-04-13 16:50:38 -07:00
hostfs
hpfs	hpfs: fix a crash if hpfs_map_dnode_bitmap fails	2026-05-25 14:48:58 +02:00
hugetlbfs	Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"	2026-05-21 19:06:11 -07:00
iomap	vfs-7.1-rc7.fixes	2026-06-06 07:28:59 -07:00
isofs	isofs: use QSTR_LEN() in isofs_cmp	2026-04-20 17:27:28 +02:00
jbd2	Various clean ups and bug fixes in ext4 for 7.1:	2026-04-17 17:08:31 -07:00
jffs2
jfs	fs: Fix return in jfs_mkdir and orangefs_mkdir	2026-05-11 14:19:01 +02:00
kernfs	Driver core changes for 7.1-rc1	2026-04-13 19:03:11 -07:00
lockd	nfsd-7.1 fixes:	2026-05-26 13:49:13 -07:00
minix
netfs	netfs, afs: Fix write skipping in dir/link writepages	2026-05-12 14:42:32 +02:00
nfs	NFS: write_completion: dereference loop-local req, not hdr->req	2026-06-02 10:27:45 +02:00
nfs_common
nfsd	nfsd-7.1 fixes:	2026-05-26 13:49:13 -07:00
nilfs2	mm.git review status for linus..mm-stable	2026-04-15 12:59:16 -07:00
nls
notify	\n	2026-04-27 16:40:24 -07:00
ntfs	ntfs: restore $MFT mirror contents check	2026-05-11 23:30:48 +09:00
ntfs3	Changes for 7.1-rc1	2026-04-20 10:59:47 -07:00
ocfs2	Fixing livelocks in shrink_dcache_tree()	2026-04-21 07:30:44 -07:00
omfs
openpromfs
orangefs	fs: Fix return in jfs_mkdir and orangefs_mkdir	2026-05-11 14:19:01 +02:00
overlayfs	ovl: keep err zero after successful ovl_cache_get()	2026-05-18 14:56:15 +02:00
proc	mm.git review status for linus..mm-nonmm-stable	2026-04-16 20:11:56 -07:00
pstore	mm.git review status for linus..mm-stable	2026-04-15 12:59:16 -07:00
qnx4
qnx6	fs/qnx6: fix pointer arithmetic in directory iteration	2026-05-28 14:16:33 +02:00
quota
ramfs
resctrl	mm.git review status for linus..mm-stable	2026-04-15 12:59:16 -07:00
romfs
smb	ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL	2026-05-31 19:13:48 -05:00
squashfs
sysfs	sysfs: don't remove existing directory on update failure	2026-05-20 17:13:20 +02:00
tests
tracefs	tracefs fixes for v7.1:	2026-04-22 15:09:01 -07:00
ubifs	mm.git review status for linus..mm-nonmm-stable	2026-04-16 20:11:56 -07:00
udf	udf: reject descriptors with oversized CRC length	2026-04-22 17:14:48 +02:00
ufs
unicode
vboxsf
verity
xfs	xfs: Remove mention of PageWriteback	2026-05-30 08:26:18 +02:00
zonefs	zonefs: handle integer overflow in zonefs_fname_to_fno	2026-05-12 07:53:20 +09:00
aio.c	fs: aio: reject partial mremap to avoid Null-pointer-dereference error	2026-04-24 00:34:59 +02:00
anon_inodes.c
attr.c
backing-file.c
bad_inode.c
binfmt_elf.c
binfmt_elf_fdpic.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
bpf_fs_kfuncs.c
buffer.c	vfs-7.1-rc1.fixes	2026-04-23 17:08:04 -07:00
char_dev.c
compat_binfmt_elf.c
coredump.c
d_path.c
dax.c	dax changes for 7.1	2026-04-21 14:12:01 -07:00
dcache.c	Fixing livelocks in shrink_dcache_tree()	2026-04-21 07:30:44 -07:00
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c	eventpoll: drop vestigial epi->dying flag	2026-04-24 00:37:01 +02:00
exec.c
fcntl.c
fhandle.c	fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()	2026-06-04 09:39:50 +02:00
file.c
file_attr.c
file_table.c	lsm/stable-7.1 PR 20260410	2026-04-13 15:17:28 -07:00
filesystems.c
fs-writeback.c	vfs-7.1-rc1.fixes	2026-04-23 17:08:04 -07:00
fs_context.c
fs_dirent.c
fs_parser.c
fs_pin.c
fs_struct.c
fserror.c
fsopen.c
init.c
inode.c	fs: fix forced iversion increment on lazytime timestamp updates	2026-05-11 15:32:12 +02:00
internal.h	lsm/stable-7.1 PR 20260410	2026-04-13 15:17:28 -07:00
ioctl.c
Kconfig
Kconfig.binfmt
kernel_read_file.c
libfs.c
locks.c	NFSD 7.1 Release Notes	2026-04-20 10:44:02 -07:00
Makefile
mbcache.c
mnt_idmapping.c	fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap	2026-05-11 14:19:01 +02:00
mount.h	fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()	2026-06-04 09:39:50 +02:00
mpage.c	mm.git review status for linus..mm-stable	2026-04-15 12:59:16 -07:00
namei.c	VFS: fix possible failure to unlock in nfsd4_create_file()	2026-05-28 14:14:04 +02:00
namespace.c	namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories	2026-06-10 07:09:20 -07:00
nsfs.c	nsfs: fix wrong error code returned for pidns ioctls	2026-05-11 15:59:14 +02:00
nullfs.c
open.c
pidfs.c
pipe.c
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
readdir.c
remap_range.c
select.c	fs/select: reject negative timeval components in kern_select()	2026-05-12 14:41:40 +02:00
seq_file.c
signalfd.c
splice.c
stack.c
stat.c
statfs.c
super.c
sync.c
sysctls.c
timerfd.c
userfaultfd.c	userfaultfd: allow registration of ranges below mmap_min_addr	2026-04-18 00:10:56 -07:00
utimes.c
xattr.c