linux-kernel - Re: [PATCH v6 9/9] ovl: Support mounting case-insensitive enabled layers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <175643085095.2234665.7900009371607929733@noble.neil.brown.name>
Date: Fri, 29 Aug 2025 11:27:30 +1000
From: "NeilBrown" <neil@...wn.name>
To: "Amir Goldstein" <amir73il@...il.com>
Cc: André Almeida <andrealmeid@...lia.com>,
 "Miklos Szeredi" <miklos@...redi.hu>, "Theodore Tso" <tytso@....edu>,
 linux-unionfs@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-fsdevel@...r.kernel.org, "Alexander Viro" <viro@...iv.linux.org.uk>,
 "Christian Brauner" <brauner@...nel.org>, "Jan Kara" <jack@...e.cz>,
 kernel-dev@...lia.com, "Gabriel Krisman Bertazi" <gabriel@...sman.be>
Subject:
 Re: [PATCH v6 9/9] ovl: Support mounting case-insensitive enabled layers

On Fri, 29 Aug 2025, Amir Goldstein wrote:
> 
> commit 32786370148617766043f6d054ff40758ce79f21 (HEAD -> ovl_casefold)
> Author: Amir Goldstein <amir73il@...il.com>
> Date:   Wed Aug 27 19:55:26 2025 +0200
> 
>     ovl: make sure that ovl_create_real() returns a hashed dentry
> 
>     e8bd877fb76bb9f3 ("ovl: fix possible double unlink") added a sanity
>     check of !d_unhashed(child) to try to verify that child dentry was not
>     unlinked while parent dir was unlocked.
> 
>     This "was not unlink" check has a false positive result in the case of
>     casefolded parent dir, because in that case, ovl_create_temp() returns
>     an unhashed dentry after ovl_create_real() gets an unhashed dentry from
>     ovl_lookup_upper() and makes it positive.
> 
>     To avoid returning unhashed dentry from ovl_create_temp(), let
>     ovl_create_real() lookup again after making the newdentry positive,
>     so it always returns a hashed positive dentry (or an error).
> 
>     This fixes the error in ovl_parent_lock() in ovl_check_rename_whiteout()
>     after ovl_create_temp() and allows mount of overlayfs with casefolding
>     enabled layers.
> 
>     Reported-by: André Almeida <andrealmeid@...lia.com>
>     Closes: https://lore.kernel.org/r/18704e8c-c734-43f3-bc7c-b8be345e1bf5@igalia.com/
>     Suggested-by: Neil Brown <neil@...wn.name>
>     Signed-off-by: Amir Goldstein <amir73il@...il.com>

Reviewed-by NeilBrown <neil@...wn.name>

Thanks,
NeilBrown


> 
> diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
> index 538a1b2dbb387..a5e9ddf3023b3 100644
> --- a/fs/overlayfs/dir.c
> +++ b/fs/overlayfs/dir.c
> @@ -212,12 +212,32 @@ struct dentry *ovl_create_real(struct ovl_fs
> *ofs, struct dentry *parent,
>                         err = -EPERM;
>                 }
>         }
> -       if (!err && WARN_ON(!newdentry->d_inode)) {
> +       if (err)
> +               goto out;
> +
> +       if (WARN_ON(!newdentry->d_inode)) {
>                 /*
>                  * Not quite sure if non-instantiated dentry is legal or not.
>                  * VFS doesn't seem to care so check and warn here.
>                  */
>                 err = -EIO;
> +       } else if (d_unhashed(newdentry)) {
> +               struct dentry *d;
> +               /*
> +                * Some filesystems (i.e. casefolded) may return an unhashed
> +                * negative dentry from the ovl_lookup_upper() call before
> +                * ovl_create_real().
> +                * In that case, lookup again after making the newdentry
> +                * positive, so ovl_create_upper() always returns a hashed
> +                * positive dentry.
> +                */
> +               d = ovl_lookup_upper(ofs, newdentry->d_name.name, parent,
> +                                    newdentry->d_name.len);
> +               dput(newdentry);
> +               if (IS_ERR_OR_NULL(d))
> +                       err = d ? PTR_ERR(d) : -ENOENT;
> +               else
> +                       return d;
>         }
>  out:
>         if (err) {
>