On Thu, Aug 21, 2025 at 3:43 PM Amir Goldstein <amir73il@xxxxxxxxx> wrote: > > From: NeilBrown <neil@xxxxxxxxxx> > > commit 5f1c8965e748c150d580a2ea8fbee1bd80d07a24 upstream. > > ovl_create_temp() treats "workdir" as a parent in which it creates an > object so it should use I_MUTEX_PARENT. > > Prior to the commit identified below the lock was taken by the caller > which sometimes used I_MUTEX_PARENT and sometimes used I_MUTEX_NORMAL. > The use of I_MUTEX_NORMAL was incorrect but unfortunately copied into > ovl_create_temp(). > > Note to backporters: This patch only applies after the last Fixes given > below (post v6.16). To fix the bug in v6.7 and later the > inode_lock() call in ovl_copy_up_workdir() needs to nest using > I_MUTEX_PARENT. > > [Amir: backport to v6.16 when lock was taken by the callers] Greg, Forgot to mention stable version in subject line. This should apply cleanly to 6.16.y and 6.12.y. Thanks, Amir. > > Link: https://lore.kernel.org/all/67a72070.050a0220.3d72c.0022.GAE@xxxxxxxxxx/ > Cc: stable@xxxxxxxxxxxxxxx > Reported-by: syzbot+7836a68852a10ec3d790@xxxxxxxxxxxxxxxxxxxxxxxxx > Tested-by: syzbot+7836a68852a10ec3d790@xxxxxxxxxxxxxxxxxxxxxxxxx > Fixes: c63e56a4a652 ("ovl: do not open/llseek lower file with upper sb_writers held") > Fixes: d2c995581c7c ("ovl: Call ovl_create_temp() without lock held.") > Signed-off-by: NeilBrown <neil@xxxxxxxxxx> > Signed-off-by: Amir Goldstein <amir73il@xxxxxxxxx> > --- > fs/overlayfs/copy_up.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c > index d7310fcf38881..c2263148ff20a 100644 > --- a/fs/overlayfs/copy_up.c > +++ b/fs/overlayfs/copy_up.c > @@ -779,7 +779,7 @@ static int ovl_copy_up_workdir(struct ovl_copy_up_ctx *c) > return err; > > ovl_start_write(c->dentry); > - inode_lock(wdir); > + inode_lock_nested(wdir, I_MUTEX_PARENT); > temp = ovl_create_temp(ofs, c->workdir, &cattr); > inode_unlock(wdir); > ovl_end_write(c->dentry); > -- > 2.50.1 >
