Merge tag 'vfs-7.4-rc3.fixes.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull more vfs fixes from Christian Brauner:

 - inode: Let the shrinker reclaim inodes with I_METADATA_WRITEBACK like
   any other clean inode and have evict() write out what the bit tracks
   unless the inode is being deleted.

   Since v7.3 ext2, ext4 without a journal, fat, udf and minix set
   I_METADATA_WRITEBACK when they copy an inode into its buffer and only
   fsync() and friends clear it again. inode_lru_isolate() took such
   inodes off the LRU expecting something to put them back once the bit
   was gone but nothing ever did. So they couldn't be reclaimed until
   something fsynced them or the filesystem was unmounted.

   On ext4 without a journal an atime update was enough to pin an inode,
   and creating 60000 small files in a memory cgroup limited to 96M got
   the task OOM killed after about 43000 of them. Now all 60000 get
   created.

 - dcache:

     - Give d_set_mounted() a seqlock of its own that d_invalidate()
       waits on after unhashing the dentry.

       Since v6.17 d_set_mounted() doesn't bump the seqcount of
       rename_lock anymore, so a mount racing d_invalidate() could end
       up below the unhashed directory. Nobody can reach it there and it
       pins the subtree until the mount namespace goes away. With a FUSE
       directory 3000 levels deep 151 of 200 bind mounts racing
       FUSE_NOTIFY_INVAL_ENTRY ended up there.

     - Only take busy secondary roots off ->s_roots in do_one_tree() so
       that umount waits for a racing eviction of an idle one. Since
       v7.3 it didn't, which ended in busy inodes after unmount and an
       iput() on a dead superblock.

     - Make a disconnected dentry a secondary root when the mount on it
       goes away so that umount finds it and waits for its eviction.
       With CAP_DAC_READ_SEARCH such a dentry can be mounted on via
       open_by_handle_at() and move_mount() and umount racing its
       eviction ended the same way.

 - splice:

     - Remove pipe buffer stealing as you and David suggested.

       fuse and virtio_console were the only users of ->try_steal() and
       now always copy, as they already did when a steal failed.
       Stealing took page cache folios out of their files and turned
       pages into page cache folios and back. SPLICE_F_GIFT and
       SPLICE_F_MOVE are still accepted and fuse still advertises
       FUSE_SPLICE_MOVE so servers that ask for it mount as before.

     - Clamp a ->write_iter() result that is larger than the iterator in
       iter_file_splice_write() instead of only warning about it.
       Otherwise the pipe releases buffers past its head.

 - ns:

     -Allocate the namespace id before calling the namespace_init LSM
      hook that was added this merge window. Landlock now logs the
      allocated id instead of zero when it denies the creation of a
      namespace.

     -Don't mark the arguments of the namespace_init and namespace_free
      hooks as trusted for bpf LSM programs. Both see namespaces that
      are only partially set up or on their way out.

 - proc: Don't let proc_sys_call_handler() report more bytes written
   than it was passed when a cgroup/sysctl bpf program replaced the
   value with a longer one. A splice() into the sysctl file then walked
   past the pipe head.

 - coda: Pass the append state of each write on to the container file
   with RWF_APPEND or RWF_NOAPPEND. coda_open() sets O_APPEND on the
   container file after its iocb flags were cached, so an O_APPEND write
   overwrote existing data instead of appending.

 - adfs: Reject big directory entries in adfs_fplus_getnext() whose name
   doesn't fit into the name buffer. A crafted image overflowed it on
   the stack.

* tag 'vfs-7.4-rc3.fixes.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits)
  nstree: drop ns_tree_add_raw()
  ns: allocate the namespace id before the namespace_init hook
  bpf: don't mark namespace_init and namespace_free arguments as trusted
  splice: replace nosteal_pipe_buf_ops with default_pipe_buf_ops
  splice: remove pipe buffer stealing
  fuse: don't move pipe buffers into the page cache
  virtio_console: copy pipe buffers in splice_write()
  fs/adfs: bound directory entry name length in adfs_fplus_getnext()
  dcache: let umount find a disconnected ex-mountpoint
  dcache: wait for a racing eviction of a secondary root
  dcache: let d_invalidate() wait for a d_set_mounted() in flight
  fat: drop mmb_sync() from fat_evict_inode()
  udf: drop mmb_sync() from udf_evict_inode()
  minix: drop mmb_sync() from minix_evict_inode()
  ext4: drop mmb_sync() from ext4_evict_inode()
  ext2: drop mmb_sync() from ext2_evict_inode()
  fs: don't strand I_METADATA_WRITEBACK inodes outside the LRU
  fs: set I_METADATA_WRITEBACK in mmb_mark_buffer_dirty()
  udf: don't allocate the inode block in udf_sync_inode_metadata()
  minix: don't read the inode block in minix_sync_inode_metadata()
  ...