Pull vfs fixes from Christian Brauner:

 - vfs: Preserve the ACL_DONT_CACHE state in forget_cached_acl().

   ACL_DONT_CACHE is meant to be a permanent opt-out from ACL caching
   which FUSE relies on for servers that don't negotiate FUSE_POSIX_ACL.
   The helper replaced it with ACL_NOT_CACHED, silently re-enabling the
   cache, and as fuse doesn't invalidate the cache for such servers a
   properly timed get_acl() returned stale ACLs. Comes with a fuse
   selftest reproducing this.

 - pidfs:

     - Preserve PIDFD_THREAD when a thread pidfd is reopened via
       open_by_handle_at(). PIDFD_THREAD shares the O_EXCL bit which
       do_dentry_open() strips after the flags have been validated, so
       the reopened pidfd silently became a process pidfd. Comes with a
       selftest.

     - Add a pidfs_dentry_open() helper so the regular pidfd allocation
       path and the file handle path share the code that forces O_RDWR
       and reapplies the pidfd flags that do_dentry_open() strips.

     - Handle FS_IOC32_GETVERSION in the compat ioctl path.

     - Make pidfs_ino_lock static.

 - iomap:

     - Fix the block range calculation in ifs_clear_range_dirty() so a
       partial clear doesn't drop the dirty state of blocks the range
       only partially covers.

     - Support invalidating partial folios so a partial truncate or hole
       punch with blocksize < foliosize doesn't leave stale dirty bits
       behind.

     - Only set did_zero when iomap_zero_iter() actually zeroed
       something.

     - Guard ifs_set_range_dirty() and ifs_set_range_uptodate() against
       zero-length ranges where the unsigned last-block calculation
       underflows and bitmap_set() writes far beyond the ifs->state
       allocation.

     - Don't merge ioends with different io_private values as the merge
       could leak or corrupt the private data of the individual ioends.

 - exec:

     - Raise bprm->have_execfd only once the binfmt_misc interpreter has
       actually been opened. The flag was set as soon as a matching 'O'
       or 'C' entry was found. If the interpreter open failed with
       ENOEXEC the exec fell through to the next binary format with
       have_execfd raised but no executable staged and begin_new_exec()
       NULL derefed past the point of no return.

     - Fix an unsigned loop counter wrap in transfer_args_to_stack() on
       nommu. An overlong argument or environment string pushes bprm->p
       below PAGE_SIZE, the stop index becomes zero, and the loop never
       terminates, wrapping its counter and copying garbage from in
       front of the page array into the new process stack.

     - Make binfmt_elf_fdpic only honour the first PT_INTERP like
       binfmt_elf does. Each additional PT_INTERP overwrote the previous
       interpreter, leaking the name allocation and the interpreter file
       reference together with the write denial open_exec() took,
       leaving the file unwritable for as long as the system runs.

 - overlayfs:

     - Compare the full escaped xattr prefix including the trailing dot.
       An xattr like "trusted.overlay.overlayfoo" was misclassified as
       an escaped overlay xattr.

     - Check read access to the copy_file_range() source with the
       source's mounter credentials.

 - super: Thawing a filesystem whose block device was frozen with
   bdev_freeze() deadlocked. Dropping the last block layer freeze
   reference from under s_umount ends up in fs_bdev_thaw() which
   reacquires s_umount on the same task. Pin the superblock with an
   active reference instead and call bdev_thaw() without holding
   s_umount.

 - procfs: Return EACCES instead of success when the ptrace access check
   for namespace links fails.

 - afs: Use afs_dir_get_block() rather than afs_dir_find_block() for
   block 0 in afs_edit_dir_remove(), matching afs_edit_dir_add().

 - Push the memcg gating of ->nr_cached_objects() down into the btrfs
   and shmem callbacks instead of skipping every callback during
   non-root memcg reclaim. The blanket check short-circuited XFS whose
   inode reclaim hook is intentionally driven from per-memcg contexts to
   free memcg-charged slab.

 - eventpoll: Pin files while checking reverse paths.

   Since struct file became SLAB_TYPESAFE_BY_RCU a concurrent close
   could free and recycle the file under the check which then took and
   dropped the f_lock of whatever live file now occupies that slot.

* tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
  super: fix emergency thaw deadlock on frozen block devices
  pidfs: make pidfs_ino_lock static
  eventpoll: pin files while checking reverse paths
  fs: push nr_cached_objects memcg gating into individual filesystems
  afs: Fix afs_edit_dir_remove() to get, not find, block 0
  iomap: prevent ioend merge when io_private differs
  iomap: add comments for ifs_clear/set_range_dirty()
  iomap: fix out-of-bounds bitmap_set() with zero-length range
  iomap: fix incorrect did_zero setting in iomap_zero_iter()
  iomap: support invalidating partial folios
  iomap: correct the range of a partial dirty clear
  fs/super: fix emergency thaw double-unlock of s_umount
  pidfs: handle FS_IOC32_GETVERSION in compat ioctl
  ovl: check access to copy_file_range source with src mounter creds
  proc: Fix broken error paths for namespace links
  pidfs: add pidfs_dentry_open() helper
  selftests/pidfd: check PIDFD_THREAD survives open_by_handle_at()
  pidfs: preserve thread pidfds reopened by file handle
  ovl: fix trusted xattr escape prefix matching
  selftests/fuse: add ACL_DONT_CACHE regression test
  ...

Pull slab fixes from Vlastimil Babka:

 - Prevent unbounded recursion in free path with memory allocation
   profiling, which has caused a stack overflow on a Meta production
   host due to a 125-deep __free_slab<->kfree recursion (Harry Yoo)

 - Fix type-based partitioning confusing sparse which does not know
   __builtin_infer_alloc_token() (Marco Elver)

 - Fix a potential memory leak in bulk freeing path on NUMA machines
   (Shengming Hu)

* tag 'slab-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
  slab: silence sparse warning with type-based partitioning
  mm/slab: prevent unbounded recursion in free path with new kmalloc type
  lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
  mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT
  mm/slab: fix a memory leak due to bootstrapping sheaves twice
  mm/slub: fix lost local objects when bulk remote free batch fills

Commit 0baad6f9b997 ("fs/super: skip non-memcg-aware nr_cached_objects
in memcg slab shrink") added a check in fs/super.c that skipped every
->nr_cached_objects() hook whenever the shrinker was invoked for a
non-root memcg, on the assumption that none of them honour sc->memcg.

That assumption is wrong for XFS, whose inode-reclaim hook is
intentionally driven from per-memcg contexts to free memcg-charged
slab. Encoding a blanket "never memcg-aware" policy in fs/super.c
short-circuits that path.

Push the check down into the callbacks whose counters really are
irrelevant to per-memcg reclaim - btrfs_nr_cached_objects() and
shmem_unused_huge_count() - and drop the fs/super.c gate. Each
filesystem can now lift the restriction independently if its counter
later grows memcg awareness, without touching fs/super.c.

Introduce mem_cgroup_shrink_is_root() in <linux/memcontrol.h> so the
callbacks don't open-code "sc->memcg is NULL or root".

Fixes: 0baad6f9b997 ("fs/super: skip non-memcg-aware nr_cached_objects in memcg slab shrink")
Acked-by: Qi Zheng <qi.zheng@linux.dev>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
Signed-off-by: Usama Arif <usama.arif@linux.dev>
Link: https://patch.msgid.link/20260715103516.2410175-1-usama.arif@linux.dev
Acked-by: David Sterba <dsterba@suse.com>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Pull misc fixes from Andrew Morton:
 "12 hotfixes. 8 are cc:stable and the remainder address post-7.1 issues
  or aren't considered appropriate for backporting. 10 are for MM.

  All are singletons - please see the relevant changelogs for details"

* tag 'mm-hotfixes-stable-2026-07-20-11-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm/memory-failure: trace: change memory_failure_event to ras subsystem
  mm: page_reporting: allow driver to set batch capacity
  mm/kmemleak: fix checksum computation for per-cpu objects
  mm/damon/core: disallow overlapping input ranges for damon_set_regions()
  MAINTAINERS: add Usama as a THP reviewer
  fat: avoid stack overflow warning
  mm/damon/core: validate ranges in damon_set_regions()
  m68k: avoid -Wunused-but-set-parameter in clear_user_page()
  mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established
  mm/page_vma_mapped: fix device-private PMD handling
  MAINTAINERS: s/SeongJae/SJ/
  userfaultfd: prevent registration of special VMAs

Commit 280ea9c3154b ("mm/slab: avoid allocating slabobj_ext array from
its own slab") avoided recursive allocation of obj_exts from kmalloc
caches of the same size, by bumping the obj_exts array's allocation
size whenever the array size equals the size of the object being
allocated.

However, as reported by Danielle Costantino and Shakeel Butt,
even slabs from kmalloc caches of different sizes can form a cycle
by allocating obj_exts arrays from each other [1]:

  What happened: a KMALLOC_NORMAL slab's obj_exts array (used by
  allocation profiling / memcg accounting) is itself kmalloc()'d from a
  KMALLOC_NORMAL cache, so the "slab holds another slab's obj_exts array"
  relation can form cycles. With sizeof(struct slabobj_ext) == 16 and
  the host's geometry:

  - kmalloc-512 has 64 objects/slab -> array is 64*16 == 1024 bytes,
    served from kmalloc-1k;
  - kmalloc-1k  has 32 objects/slab -> array is 32*16 ==  512 bytes,
    served from kmalloc-512.

  A kmalloc-512 slab and a kmalloc-1k slab therefore hold each other's
  obj_exts array.  Discarding one frees the other's array, which empties
  and discards that slab, which frees the first's array, and so on:
  __free_slab() -> free_slab_obj_exts() -> kfree() -> discard_slab() ->
  __free_slab() recurses along the cycle until the stack is exhausted.

With memory allocation profiling, this allows unbounded recursion
in the free path and led to a stack overflow on a production host in
the Meta fleet [1]:

  BUG: TASK stack guard page was hit
  Oops: stack guard page
  RIP: 0010:kfree+0x8/0x5d0
  Call Trace:
   __free_slab+0x66/0xc0
   kfree+0x3f0/0x5d0
   ... ( ~125x __free_slab <-> kfree ) ...
   <kernel driver freeing a resource>
   do_syscall_64

It is proposed [1] to resolve this issue by always serving the obj_exts
array allocation from kmalloc caches (or large kmalloc) of sizes larger
than the object size. However, as pointed out by Vlastimil Babka [2],
this can waste an excessive amount of memory as slabs from large
kmalloc sizes (e.g. kmalloc-8k) generally need obj_exts arrays much
smaller than the object size.

Therefore, rather than bumping the size, let us take a different
approach; disallow formation of cycles between kmalloc types when
allocating obj_exts arrays. Currently, all obj_exts arrays are served
from normal kmalloc caches. Cycles cannot be created if obj_exts arrays
of normal kmalloc caches are served from a special kmalloc type that can
never have obj_exts arrays.

To achieve this, create a new kmalloc type called KMALLOC_NO_OBJ_EXT.
KMALLOC_NO_OBJ_EXT caches are created with SLAB_NO_OBJ_EXT flag when
either 1) memory allocation profiling is not permanently disabled,
or 2) kmalloc types with a priority higher than KMALLOC_CGROUP are
aliased with KMALLOC_NORMAL.

Sheaf bootstrapping for KMALLOC_NO_OBJ_EXT caches now must be deferred
because allocation of a barn can trigger obj_exts array allocation of
normal kmalloc caches when the KMALLOC_NO_OBJ_EXT cache for that size
is not ready yet. For simplicity, perform bootstrapping of sheaves for
all kmalloc caches later.

Introduce a new slab alloc flag, SLAB_ALLOC_NO_OBJ_EXT, to prevent
allocation of obj_exts arrays, and let kmalloc_slab() override the type
to KMALLOC_NO_OBJ_EXT when specified. Note that kmalloc_type() remains
unchanged because kmalloc_flags() bypasses the kmalloc fastpath.

Do not pass SLAB_ALLOC_NO_RECURSE to kmalloc_flags() in
alloc_slab_obj_exts() and instead use SLAB_ALLOC_NO_OBJ_EXT only when
the objects are allocated from normal kmalloc caches. While this
prevents unbounded recursive allocation of obj_exts, it allows
KMALLOC_NO_OBJ_EXT caches to have sheaves.

Since sheaf allocations specify SLAB_ALLOC_NO_RECURSE that prevents
allocation of both sheaves and obj_exts arrays, the recursion depth
is bounded.

obj_exts arrays for non-kmalloc-normal caches can now have a valid tag.
Do not call mark_obj_codetag_empty() when freeing an obj_exts array to
avoid false warnings. KMALLOC_NO_OBJ_EXT don't need this as they never
allocate those arrays.

Reported-by: Danielle Costantino <dcostantino@meta.com>
Reported-by: Shakeel Butt <shakeel.butt@linux.dev>
Closes: https://lore.kernel.org/linux-mm/20260625230029.703750-1-shakeel.butt@linux.dev [1]
Fixes: 4b8736964640 ("mm/slab: add allocation accounting into slab allocation and free paths")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-mm/c5c4208d-a6f0-413e-bad9-49be12f12d55@kernel.org [2]
Signed-off-by: Harry Yoo (Oracle) <harry@kernel.org>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Link: https://patch.msgid.link/20260713-kmalloc-no-objext-v3-4-47c7bd138de7@kernel.org
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>

Bootstrap caches are created with SLAB_NO_OBJ_EXT to disallow sheaves
and obj_exts.

To allow disabling obj_exts while allowing sheaves, decouple
SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT. Bootstrap caches now have both
SLAB_NO_SHEAVES and SLAB_NO_OBJ_EXT.

No functional change intended.

Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Harry Yoo (Oracle) <harry@kernel.org>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Link: https://patch.msgid.link/20260713-kmalloc-no-objext-v3-2-47c7bd138de7@kernel.org
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>

When kmalloc caches are aliased, multiple cache pointers reference
the same kmem_cache. As a result, iterating over kmalloc indices and
bootstrapping sheaves can bootstrap the same cache more than once and
leak memory.

Currently, this could happen when the architecture specifies
minimum alignment for slab caches that is larger than
ARCH_KMALLOC_MINALIGN.

Bootstrap sheaves only when the cache does not have them already.
Add a warning when bootstrap_cache_sheaves() is called for a cache
that already has sheaves enabled.

Fixes: 913ffd3a1bf5 ("slab: handle kmalloc sheaves bootstrap")
Cc: stable@vger.kernel.org
Signed-off-by: Harry Yoo (Oracle) <harry@kernel.org>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Link: https://patch.msgid.link/20260713-kmalloc-no-objext-v3-1-47c7bd138de7@kernel.org
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>

section_activate() does not flush TLB after populating new vmemmap
pages. On most architectures, this is okay. However it is a problem on
RISC-V since there the TLB caching non-present entries is permitted,
which causes spurious faults on some hardwares.

This seems to be most easily reproduced with DEBUG_VM=y and
PAGE_POISONING=y, which causes these newly mapped struct pages to be
poisoned i.e. written to immediately after mapping.

Extend the RISC-V flush_cache_vmap() to also handle the vmemmap range,
and call it after hotplugging vmemmap, which gets the possible spurious
fault handled in the exception handler.

At least for now, the only other architecture with both
SPARSEMEM_VMEMMAP and flush_cache_vmap() is PowerPC, which has a similar
problem with newly valid PTEs. But there flush_cache_vmap() is just a
ptesync. So it should be safe to do this for generic code while having
minimal performance impact.

Suggested-by: Muchun Song <muchun.song@linux.dev>
Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Link: https://patch.msgid.link/20260713-mark-after-vmemmap-populate-v6-2-b945ceba29d4@iscas.ac.cn
Signed-off-by: Paul Walmsley <pjw@kernel.org>

At the moment, if a virtio balloon device has a page reporting vq but its
size is < PAGE_REPORTING_CAPACITY (32), the balloon driver fails probe.

But, there's no way for host to know this value, so it can easily create a
smaller vq and suddenly adding the reporting capability to the device
makes all of the driver fail.  Not pretty.

Add a capacity field to page_reporting_dev_info so drivers can control the
maximum number of pages per report batch.

In virtio-balloon, set the capacity to the reporting virtqueue size,
letting page_reporting adapt to whatever the device provides.

Capacity need not be a power of two.  Code previously called out division
by PAGE_REPORTING_CAPACITY as cheap since it was a power of 2, but no
performance difference was observed with non-power-of-2 values.

If capacity is 0 or exceeds PAGE_REPORTING_CAPACITY, it defaults to
PAGE_REPORTING_CAPACITY.  The 0 check and the clamping is done in
page_reporting_register(), before the reporting work is scheduled, so we
never get division by 0.

Link: https://lore.kernel.org/444c24cf39f3f3620fc90ef4695bd6b0979f4c4b.1783232420.git.mst@redhat.com
Fixes: b0c504f15471 ("virtio-balloon: add support for providing free page reports to host")
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Assisted-by: Claude:claude-opus-4-6
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Gregory Price <gourry@gourry.net>
Acked-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
Cc: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Eugenio Pérez <eperezma@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

The per-cpu object checksum folds each CPU's CRC together with XOR and
seeds every CRC with 0.  Both choices make update_checksum() miss content
changes:

  - XOR is self-cancelling, so equal contents on two CPUs cancel out and
    simultaneous identical changes leave the checksum unchanged.
  - crc32(0, ...) over all-zero content is 0, so a freshly allocated,
    zeroed per-cpu area checksums to 0, matching the initial value, and
    the object is never seen to change.

See discussions at [0].

When update_checksum() wrongly reports an actively modified object as
unchanged, kmemleak stops greying it for an extra scan and can report a
live per-cpu object as a leak.

Fold the per-cpu CRC as a single rolling checksum across all CPUs and
initialise the object checksum to ~0 so the first computed value always
registers as a change, even for content that hashes to 0. 
reset_checksum() is seeded the same way.

Link: https://lore.kernel.org/all/akfYImSNDh3OjIfR@gmail.com [0]
Link: https://lore.kernel.org/20260703-kmemleak_checksum-v1-1-5e0ab7d6966f@debian.org
Fixes: 6c99d4eb7c5e ("kmemleak: enable tracking for percpu pointers")
Signed-off-by: Breno Leitao <leitao@debian.org>
Co-developed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>