[PATCH 0/8] afs: Miscellaneous fixes

[David Howells]

Hi Christian,

Can you pick up these miscellaneous AFS fixes, please?  Note that some of
these are derived from Sashiko review of some rxrpc patches[1][2].

 (1) Fix afs_fs_fetch_data() to set call->async.

 (2) Fix afs_fs_fetch_data() to subtract transferred from len instead of
     adding it.

 (3) Fix a UAF when sending a message if the call is completed so quickly
     that the sending code hasn't finished with it when it gets freed.

 (4) Fix missing kunmap in afs_dir_search_bucket().

 (5) Fix afs_edit_dir_remove() to get, not find, block 0.

 (6) Fix double-unmap of directory block.

There are also two fixes to fix the issue behind a work-around in bash that is
now being removed[3][4].

 (7) Allow filesystems with foreign owner IDs to override UID checks.

 (8) Use (7) to fix open(O_CREAT) on an extant AFS file in a sticky dir.

The patches can be found here:

	https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/log/?h=afs-fixes

Thanks,
David

[1] https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redh
[2] https://sashiko.dev/#/patchset/20260713081022.2186481-1-dhowells%40red
[3] https://groups.google.com/g/gnu.bash.bug/c/6PPTfOgFdL4/m/2AQU-S1N76UJ
[4] Link: https://git.savannah.gnu.org/cgit/bash.git/tree/redir.c?h=bash-5.3-rc1#n733

David Howells (8):
  afs: Fix afs_fs_fetch_data() to set call->async
  afs: Fix afs_fs_fetch_data() to subtract transferred from len
  afs: Fix UAF when sending a message
  afs: Fix missing kunmap in afs_dir_search_bucket()
  afs: Fix afs_edit_dir_remove() to get, not find, block 0
  afs: Fix double-unmap of directory block
  vfs: Allow filesystems with foreign owner IDs to override UID checks
  afs, bash: Fix open(O_CREAT) on an extant AFS file in a sticky dir

 Documentation/filesystems/vfs.rst |  21 ++++
 fs/afs/dir.c                      |   2 +
 fs/afs/dir_edit.c                 |  11 +-
 fs/afs/dir_search.c               |  11 +-
 fs/afs/file.c                     |   2 +
 fs/afs/fsclient.c                 |   5 +-
 fs/afs/inode.c                    |   1 +
 fs/afs/internal.h                 |  14 ++-
 fs/afs/security.c                 |  46 +++++++++
 fs/attr.c                         |  58 ++++++-----
 fs/coredump.c                     |   2 +-
 fs/inode.c                        |  11 +-
 fs/internal.h                     |   1 +
 fs/locks.c                        |   7 +-
 fs/namei.c                        | 161 ++++++++++++++++++++++++------
 fs/remap_range.c                  |  20 ++--
 include/linux/fs.h                |   7 +-
 17 files changed, 290 insertions(+), 90 deletions(-)