Miklos Szeredi e09412a714 virtiofs: fix UAF on submount umount ... commit 06b41351779e9289e8785694ade9042ae85e41ea upstream. iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go down to zero before commencing with super block shutdown. This only works, however, for the last submount instance, as the wait counter is per connection, not per superblock. Revert to using synchronous release requests for the auto_submounts case, which is virtiofs only at this time. Reported-by: Aurélien Bombo <abombo@microsoft.com> Reported-by: Zhihao Cheng <chengzhihao1@huawei.com> Cc: Greg Kurz <gkurz@redhat.com> Closes: https://github.com/kata-containers/kata-containers/issues/12589 Fixes: 26e5c67deb ("fuse: fix livelock in synchronous file put from fuseblk workers") Cc: stable@vger.kernel.org Reviewed-by: Greg Kurz <gkurz@redhat.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2026-06-27 11:08:18 +01:00
..
9p	netfs: Fix potential for tearing in ->remote_i_size and ->zero_point	2026-05-12 14:42:30 +02:00
adfs	ARM development for 7.1-rc1	2026-04-25 07:44:26 -07:00
affs	Fixing livelocks in shrink_dcache_tree()	2026-04-21 07:30:44 -07:00
afs	afs: Fix the locking used by afs_get_link()	2026-05-12 14:42:33 +02:00
autofs	vfs-7.1-rc1.misc	2026-04-13 14:20:11 -07:00
befs	treewide: change inode->i_ino from unsigned long to u64	2026-03-06 14:31:28 +01:00
bfs	vfs-7.1-rc1.bh.metadata	2026-04-13 12:46:42 -07:00
btrfs	for-7.1-rc4-tag	2026-05-23 16:54:48 -07:00
cachefiles	cachefiles: Fix error return when vfs_mkdir() fails	2026-05-15 15:32:43 +02:00
ceph	ceph: put folios not suitable for writeback	2026-05-11 10:39:22 +02:00
coda	coda cleanups and fixes	2026-04-21 14:03:10 -07:00
configfs
cramfs	treewide: change inode->i_ino from unsigned long to u64	2026-03-06 14:31:28 +01:00
crypto	fscrypt updates for 7.1	2026-04-13 17:29:12 -07:00
debugfs	debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()	2026-04-02 16:15:23 +02:00
devpts
dlm	ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs	2026-03-29 11:21:22 -07:00
ecryptfs	eCryptfs changes for 7.1-rc1	2026-04-20 10:54:17 -07:00
efivarfs	efivarfs: use QSTR() in efivarfs_alloc_dentry	2026-04-28 12:30:59 +02:00
efs	treewide: change inode->i_ino from unsigned long to u64	2026-03-06 14:31:28 +01:00
erofs	erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check()	2026-06-02 01:52:58 +08:00
exfat	Description for this pull request:	2026-04-13 16:57:31 -07:00
exportfs	Fixing livelocks in shrink_dcache_tree()	2026-04-21 07:30:44 -07:00
ext2	\n	2026-04-15 19:22:16 -07:00
ext4	Various clean ups and bug fixes in ext4 for 7.1:	2026-04-17 17:08:31 -07:00
f2fs	f2fs-for-7.1-rc1	2026-04-21 14:50:04 -07:00
fat	vfs-7.1-rc1.bh.metadata	2026-04-13 12:46:42 -07:00
freevxfs	treewide: change inode->i_ino from unsigned long to u64	2026-03-06 14:31:28 +01:00
fuse	virtiofs: fix UAF on submount umount	2026-06-27 11:08:18 +01:00
gfs2	gfs2 changes	2026-04-15 19:12:04 -07:00
hfs	vfs-7.1-rc1.misc	2026-04-13 14:20:11 -07:00
hfsplus	hfs/hfsplus updates for v7.1	2026-04-13 16:50:38 -07:00
hostfs
hpfs	hpfs: fix a crash if hpfs_map_dnode_bitmap fails	2026-05-25 14:48:58 +02:00
hugetlbfs	Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"	2026-05-21 19:06:11 -07:00
iomap	vfs-7.1-rc7.fixes	2026-06-06 07:28:59 -07:00
isofs	isofs: use QSTR_LEN() in isofs_cmp	2026-04-20 17:27:28 +02:00
jbd2	Various clean ups and bug fixes in ext4 for 7.1:	2026-04-17 17:08:31 -07:00
jffs2	treewide: change inode->i_ino from unsigned long to u64	2026-03-06 14:31:28 +01:00
jfs	fs: Fix return in jfs_mkdir and orangefs_mkdir	2026-05-11 14:19:01 +02:00
kernfs	Driver core changes for 7.1-rc1	2026-04-13 19:03:11 -07:00
lockd	nfsd-7.1 fixes:	2026-05-26 13:49:13 -07:00
minix	vfs-7.1-rc1.bh.metadata	2026-04-13 12:46:42 -07:00
netfs	netfs, afs: Fix write skipping in dir/link writepages	2026-05-12 14:42:32 +02:00
nfs	NFS: write_completion: dereference loop-local req, not hdr->req	2026-06-02 10:27:45 +02:00
nfs_common
nfsd	Revert "NFSD: Defer sub-object cleanup in export put callbacks"	2026-06-27 11:08:17 +01:00
nilfs2	mm.git review status for linus..mm-stable	2026-04-15 12:59:16 -07:00
nls
notify	\n	2026-04-27 16:40:24 -07:00
ntfs	ntfs: restore $MFT mirror contents check	2026-05-11 23:30:48 +09:00
ntfs3	Changes for 7.1-rc1	2026-04-20 10:59:47 -07:00
ocfs2	Fixing livelocks in shrink_dcache_tree()	2026-04-21 07:30:44 -07:00
omfs	vfs-7.1-rc1.misc	2026-04-13 14:20:11 -07:00
openpromfs
orangefs	fs: Fix return in jfs_mkdir and orangefs_mkdir	2026-05-11 14:19:01 +02:00
overlayfs	ovl: keep err zero after successful ovl_cache_get()	2026-05-18 14:56:15 +02:00
proc	mm.git review status for linus..mm-nonmm-stable	2026-04-16 20:11:56 -07:00
pstore	mm.git review status for linus..mm-stable	2026-04-15 12:59:16 -07:00
qnx4	vfs-7.1-rc1.bh.metadata	2026-04-13 12:46:42 -07:00
qnx6	fs/qnx6: fix pointer arithmetic in directory iteration	2026-05-28 14:16:33 +02:00
quota	quota: Fix race of dquot_scan_active() with quota deactivation	2026-03-25 13:15:36 +01:00
ramfs	folio_batch: rename pagevec.h to folio_batch.h	2026-04-05 13:53:07 -07:00
resctrl	mm.git review status for linus..mm-stable	2026-04-15 12:59:16 -07:00
romfs
smb	ksmbd: reject non-VALID session in compound request branch	2026-06-27 11:08:17 +01:00
squashfs
sysfs	sysfs: don't remove existing directory on update failure	2026-05-20 17:13:20 +02:00
tests	fs/tests: exec: Remove bad test vector	2026-03-18 11:41:53 -07:00
tracefs	tracefs fixes for v7.1:	2026-04-22 15:09:01 -07:00
ubifs	mm.git review status for linus..mm-nonmm-stable	2026-04-16 20:11:56 -07:00
udf	udf: reject descriptors with oversized CRC length	2026-04-22 17:14:48 +02:00
ufs	vfs-7.1-rc1.bh.metadata	2026-04-13 12:46:42 -07:00
unicode
vboxsf
verity	vfs-7.1-rc1.kino	2026-04-13 12:19:01 -07:00
xfs	xfs: Remove mention of PageWriteback	2026-05-30 08:26:18 +02:00
zonefs	zonefs: handle integer overflow in zonefs_fname_to_fno	2026-05-12 07:53:20 +09:00
aio.c	fs: aio: reject partial mremap to avoid Null-pointer-dereference error	2026-04-24 00:34:59 +02:00
anon_inodes.c
attr.c	fs: attr: fix comment formatting and spelling issues	2026-04-07 11:26:11 +02:00
backing-file.c	lsm: add backing_file LSM hooks	2026-04-03 16:53:50 -04:00
bad_inode.c
binfmt_elf.c	mm: unexport vm_brk_flags() and eliminate vm_flags parameter	2026-04-05 13:53:39 -07:00
binfmt_elf_fdpic.c	vfs-7.1-rc1.kino	2026-04-13 12:19:01 -07:00
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
bpf_fs_kfuncs.c
buffer.c	vfs-7.1-rc1.fixes	2026-04-23 17:08:04 -07:00
char_dev.c
compat_binfmt_elf.c
coredump.c	vfs-7.1-rc1.misc	2026-04-13 14:20:11 -07:00
d_path.c	dcache: permit dynamic_dname()s up to NAME_MAX	2026-04-07 12:32:22 +02:00
dax.c	dax changes for 7.1	2026-04-21 14:12:01 -07:00
dcache.c	Fixing livelocks in shrink_dcache_tree()	2026-04-21 07:30:44 -07:00
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c	eventpoll: drop vestigial epi->dying flag	2026-04-24 00:37:01 +02:00
exec.c	exec: use strnlen() in __set_task_comm	2026-04-01 12:26:07 -07:00
fcntl.c	fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling	2026-06-19 13:50:57 +02:00
fhandle.c	fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()	2026-06-04 09:39:50 +02:00
file.c	vfs-7.1-rc1.misc	2026-04-13 14:20:11 -07:00
file_attr.c
file_table.c	lsm/stable-7.1 PR 20260410	2026-04-13 15:17:28 -07:00
filesystems.c
fs-writeback.c	vfs-7.1-rc1.fixes	2026-04-23 17:08:04 -07:00
fs_context.c	vfs-7.1-rc1.misc	2026-04-13 14:20:11 -07:00
fs_dirent.c
fs_parser.c
fs_pin.c
fs_struct.c
fserror.c	treewide: change inode->i_ino from unsigned long to u64	2026-03-06 14:31:28 +01:00
fsopen.c
init.c
inode.c	fs: fix forced iversion increment on lazytime timestamp updates	2026-05-11 15:32:12 +02:00
internal.h	lsm/stable-7.1 PR 20260410	2026-04-13 15:17:28 -07:00
ioctl.c
Kconfig
Kconfig.binfmt
kernel_read_file.c
libfs.c	vfs-7.1-rc1.bh.metadata	2026-04-13 12:46:42 -07:00
locks.c	NFSD 7.1 Release Notes	2026-04-20 10:44:02 -07:00
Makefile
mbcache.c	vfs-7.1-rc1.misc	2026-04-13 14:20:11 -07:00
mnt_idmapping.c	fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap	2026-05-11 14:19:01 +02:00
mount.h	fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()	2026-06-04 09:39:50 +02:00
mpage.c	mm.git review status for linus..mm-stable	2026-04-15 12:59:16 -07:00
namei.c	VFS: fix possible failure to unlock in nfsd4_create_file()	2026-05-28 14:14:04 +02:00
namespace.c	namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories	2026-06-10 07:09:20 -07:00
nsfs.c	nsfs: fix wrong error code returned for pidns ioctls	2026-05-11 15:59:14 +02:00
nullfs.c
open.c	fs: remove do_sys_truncate	2026-03-23 12:41:58 +01:00
pidfs.c	vfs-7.1-rc1.pidfs	2026-04-13 13:27:11 -07:00
pipe.c	treewide: change inode->i_ino from unsigned long to u64	2026-03-06 14:31:28 +01:00
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
readdir.c	fs: Replace user_access_{begin/end} by scoped user access	2026-03-24 14:44:02 +01:00
remap_range.c
select.c	fs/select: reject negative timeval components in kern_select()	2026-05-12 14:41:40 +02:00
seq_file.c
signalfd.c
splice.c
stack.c
stat.c
statfs.c
super.c
sync.c
sysctls.c
timerfd.c
userfaultfd.c	userfaultfd: allow registration of ranges below mmap_min_addr	2026-04-18 00:10:56 -07:00
utimes.c
xattr.c