Add a regression test for the fsuidgid_has_mapping() check in
vfs_tmpfile().  It idmaps a detached tmpfs mount so that the
caller-visible id range [0, 10000) maps onto the on-disk range
[10000, 20000) and checks that:

  - a caller whose fsuid/fsgid fall outside that range cannot create an
    O_TMPFILE through the mount and gets -EOVERFLOW instead of an inode
    owned by (uid_t)-1;

  - a mapped caller can create an O_TMPFILE, link it into the namespace,
    and the ownership round-trips through the mount idmap: it is reported
    as 0 through the mount and stored as 10000 on the underlying tmpfs.

The test runs entirely as root and uses setfsuid()/setfsgid() to become
the unmapped caller, so it needs no helper user.  The layer directory is
world-writable so that an unmapped caller still clears the directory
permission check and reaches the fsuidgid_has_mapping() test.

Link: https://patch.msgid.link/20260615-work-idmapped-tmpfile-v1-2-754a94d81f83@kernel.org
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Pull eventpoll updates from Christian Brauner:

 - eventpoll clarity refactor

   The recent eventpoll UAF fixes (a6dc643c6931 and follow-ups) depended
   on invariants in fs/eventpoll.c that were nowhere documented and had
   to be reverse-engineered from the code: the lifetime relationships
   between struct eventpoll, struct epitem, and struct file, the three
   removal paths coordinating via epi_fget() pins and ep->mtx, the
   ovflist sentinel-encoded scan state machine, the POLLFREE
   release/acquire handshake, and the loop / path check globals
   serialized by epnested_mutex. The fixes were correct but the next
   person to touch this code would hit the same learning curve.

   This series codifies those invariants in source and tightens the
   surrounding structure. No functional changes intended:

     - Documentation: a top-of-file overview with field-protection
       tables for struct eventpoll and struct epitem, a section
       gathering the loop-check / path-check globals next to their
       declarations, labelled comments on the two sides of the POLLFREE
       handshake, refreshed comments on epi_fget() and ep_remove_file(),
       and a docblock on ep_clear_and_put() that names its two-pass
       structure as load-bearing.

     - Mechanical renames: ep_refcount_dec_and_test() -> ep_put() to
       pair with ep_get(), attach_epitem() -> ep_attach_file() for
       ep_remove_file() symmetry, the unused depth argument dropped from
       epoll_mutex_lock(), and the CONFIG_KCMP block relocated next to
       CONFIG_COMPAT so the hot-path code is contiguous.

     - Helper extraction: ep_insert() splits into ep_alloc_epitem() and
       ep_register_epitem(), ep_clear_and_put()'s two passes become
       ep_drain_pollwaits() and ep_drain_tree() so the ordering
       invariant is enforced by the call sequence rather than
       convention, the per-event delivery loop body becomes
       ep_deliver_event(), and the ep->mtx + epnested_mutex acquisition
       dance lifts out of do_epoll_ctl() into ep_ctl_lock() /
       ep_ctl_unlock().

     - Sentinel and predicate cleanup: the EP_UNACTIVE_PTR overload is
       hidden behind named helpers (ep_is_scanning, epi_on_ovflist,
       ...), epi->next is renamed to epi->ovflist_next, and the boolean
       predicates return bool.

     - The per-CTL_ADD scratch state (tfile_check_list, path_count[],
       inserting_into) moves from file-scope globals into a
       stack-allocated struct ep_ctl_ctx plumbed through the loop / path
       check chain.

   Two follow-up fixes are included: missing kernel-doc for the new @ctx
   parameters, and restoring the EP_UNACTIVE_PTR sentinel for
   ctx->tfile_check_list - replacing it with NULL termination broke
   ep_remove_file()'s "never listed" check for the list tail, causing a
   syzbot-reported use-after-free.

 - io_uring related epoll cleanups

   One of the nastier things about epoll is how it allows nesting
   contexts inside each other, leading to the necessity of loop
   detection and the issues that have come with that. There is no reason
   to support nesting on the io_uring side, so contain the damage and
   disallow nested contexts from there: eventpoll gains a file based
   control interface and struct epoll_filefd is renamed to epoll_key.
   The io_uring side proper goes on top of this through the block tree.

 - Fix epoll_wait() reporting false negatives

   ep_events_available() checks ep->rdllist and ep_is_scanning() without
   a lock and can race with a concurrent scan such that neither check
   sees the events, causing epoll_wait() with a zero timeout to wrongly
   report no events even though events are available. A sequence lock
   closes the race and a reproducer is added to the eventpoll selftests.

* tag 'vfs-7.2-rc1.eventpoll' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (25 commits)
  eventpoll: restore EP_UNACTIVE_PTR sentinel for ctx->tfile_check_list
  eventpoll: Fix epoll_wait() report false negative
  selftests/eventpoll: Add test for multiple waiters
  eventpoll: add missing kernel-doc for @ctx function parameters
  eventpoll: rename struct epoll_filefd to epoll_key
  eventpoll: add file based control interface
  eventpoll: export is_file_epoll()
  eventpoll: pass struct epoll_filefd through ep_find() and ep_insert()
  eventpoll: hoist CTL_ADD scratch state into struct ep_ctl_ctx
  eventpoll: use bool for predicate helpers
  eventpoll: rename epi->next and txlist for clarity
  eventpoll: wrap EP_UNACTIVE_PTR in typed sentinel helpers
  eventpoll: extract lock dance from do_epoll_ctl() into ep_ctl_lock()
  eventpoll: extract ep_deliver_event() from ep_send_events()
  eventpoll: split ep_clear_and_put() into drain helpers
  eventpoll: split ep_insert() into alloc + register stages
  eventpoll: relocate KCMP helpers near compat syscalls
  eventpoll: rename attach_epitem() to ep_attach_file()
  eventpoll: drop unused depth argument from epoll_mutex_lock()
  eventpoll: rename ep_refcount_dec_and_test() to ep_put()
  ...

Add a test whichs creates 64 threads who all epoll_wait() on the same
eventpoll. The source eventfd is written but never read, therefore all the
threads should always see an EPOLLIN event.

This test fails because of a kernel bug, which will be fixed by a follow-up
commit.

Signed-off-by: Nam Cao <namcao@linutronix.de>
Link: https://patch.msgid.link/b11947013563875c046c0b0959c29fd95eeebd34.1780422138.git.namcao@linutronix.de
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Convert the emptypath selftests to the
FIXTURE_SETUP()/FIXTURE_TEARDOWN() and the two checks become TEST_F()s.
No change in coverage.

Link: https://patch.msgid.link/20260521-wettstreit-meinen-46271dede480@brauner
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Just a happy path test.

Christian Brauner <brauner@kernel.org> says:

Update OPENAT2_REGULAR fallback define to match upper-32-bit UAPI value.
Port the test to the kselftest_harness TEST*/FIXTURE framework to match
the migrated openat2_test.c, and add a regression test ensuring
open()/openat() keep ignoring the internal __O_REGULAR carrier bit.

Signed-off-by: Dorjoy Chowdhury <dorjoychy111@gmail.com>
Link: https://patch.msgid.link/20260328172314.45807-3-dorjoychy111@gmail.com
Reviewed-by: Aleksa Sarai <aleksa@amutable.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Add tests for the new O_EMPTYPATH flag of openat(2)/openat2(2).

Also, the current openat2 tests include a helper header file that
defines the necessary structs and constants to use openat2(2), such as
struct open_how. This may result in conflicting definitions when the
system header openat2.h is present as well.

So add openat2.h generated by 'make headers' to the uapi header
files in ./tools/include and remove the helper file definitions of
the current openat2 selftests.

Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
Link: https://patch.msgid.link/20260424114611.1678641-3-jkoolstra@xs4all.nl
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

These tests were written in the early days of selftests' TAP support,
the more modern kselftest harness is much easier to follow and maintain.
The actual contents of the tests are unchanged by this change. Most of
the diff involves switching from the E_* syscall wrappers we previously
used to ASSERT_EQ(fn(...), 0) in tests and helper functions.

The first pass of the migration was done using Claude, followed by a
manual rework and review.

Assisted-by: Claude:claude-4.6-opus
Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
Link: https://patch.msgid.link/20260401-openat2-selftests-kunit-v2-4-ad153a07da0c@amutable.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

For whatever reason, the original version of the tests used a custom
version of ARRAY_SIZE, but ARRAY_SIZE works just as well.

Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
Link: https://patch.msgid.link/20260401-openat2-selftests-kunit-v2-3-ad153a07da0c@amutable.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

This is a bit ugly, but in the next patch we will move to using
kselftest_harness.h -- which doesn't play well with being included in
multiple compilation units due to duplicate function definitions.

Not including kselftest_harness.h would let us avoid this patch, but the
helpers will need include kselftest_harness.h in order to switch to
TH_LOG.

Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
Link: https://patch.msgid.link/20260401-openat2-selftests-kunit-v2-2-ad153a07da0c@amutable.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

These tests really should've always belonged there, doubly so now that
they include a lot of other generic filesystem-related tests.

Suggested-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
Link: https://patch.msgid.link/20260401-openat2-selftests-kunit-v2-1-ad153a07da0c@amutable.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>