On Fri, 29 Aug 2025, Amir Goldstein wrote:
>
> commit 32786370148617766043f6d054ff40758ce79f21 (HEAD -> ovl_casefold)
> Author: Amir Goldstein <amir73il@xxxxxxxxx>
> Date: Wed Aug 27 19:55:26 2025 +0200
>
> ovl: make sure that ovl_create_real() returns a hashed dentry
>
> e8bd877fb76bb9f3 ("ovl: fix possible double unlink") added a sanity
> check of !d_unhashed(child) to try to verify that child dentry was not
> unlinked while parent dir was unlocked.
>
> This "was not unlink" check has a false positive result in the case of
> casefolded parent dir, because in that case, ovl_create_temp() returns
> an unhashed dentry after ovl_create_real() gets an unhashed dentry from
> ovl_lookup_upper() and makes it positive.
>
> To avoid returning unhashed dentry from ovl_create_temp(), let
> ovl_create_real() lookup again after making the newdentry positive,
> so it always returns a hashed positive dentry (or an error).
>
> This fixes the error in ovl_parent_lock() in ovl_check_rename_whiteout()
> after ovl_create_temp() and allows mount of overlayfs with casefolding
> enabled layers.
>
> Reported-by: André Almeida <andrealmeid@xxxxxxxxxx>
> Closes: https://lore.kernel.org/r/18704e8c-c734-43f3-bc7c-b8be345e1bf5@xxxxxxxxxx/
> Suggested-by: Neil Brown <neil@xxxxxxxxxx>
> Signed-off-by: Amir Goldstein <amir73il@xxxxxxxxx>
Reviewed-by NeilBrown <neil@xxxxxxxxxx>
Thanks,
NeilBrown
>
> diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
> index 538a1b2dbb387..a5e9ddf3023b3 100644
> --- a/fs/overlayfs/dir.c
> +++ b/fs/overlayfs/dir.c
> @@ -212,12 +212,32 @@ struct dentry *ovl_create_real(struct ovl_fs
> *ofs, struct dentry *parent,
> err = -EPERM;
> }
> }
> - if (!err && WARN_ON(!newdentry->d_inode)) {
> + if (err)
> + goto out;
> +
> + if (WARN_ON(!newdentry->d_inode)) {
> /*
> * Not quite sure if non-instantiated dentry is legal or not.
> * VFS doesn't seem to care so check and warn here.
> */
> err = -EIO;
> + } else if (d_unhashed(newdentry)) {
> + struct dentry *d;
> + /*
> + * Some filesystems (i.e. casefolded) may return an unhashed
> + * negative dentry from the ovl_lookup_upper() call before
> + * ovl_create_real().
> + * In that case, lookup again after making the newdentry
> + * positive, so ovl_create_upper() always returns a hashed
> + * positive dentry.
> + */
> + d = ovl_lookup_upper(ofs, newdentry->d_name.name, parent,
> + newdentry->d_name.len);
> + dput(newdentry);
> + if (IS_ERR_OR_NULL(d))
> + err = d ? PTR_ERR(d) : -ENOENT;
> + else
> + return d;
> }
> out:
> if (err) {
>
