6.12-stable patches

added patches:
	ovl-use-i_mutex_parent-when-locking-parent-in-ovl_create_temp.patch

diff --git a/queue-6.12/ovl-use-i_mutex_parent-when-locking-parent-in-ovl_create_temp.patch b/queue-6.12/ovl-use-i_mutex_parent-when-locking-parent-in-ovl_create_temp.patch
new file mode 100644 (file)
index 0000000..8793745
--- /dev/null
+++ b/queue-6.12/ovl-use-i_mutex_parent-when-locking-parent-in-ovl_create_temp.patch
@@ -0,0 +1,46 @@
+From 5f1c8965e748c150d580a2ea8fbee1bd80d07a24 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neil@brown.name>
+Date: Mon, 4 Aug 2025 22:11:28 +1000
+Subject: ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()
+
+From: NeilBrown <neil@brown.name>
+
+commit 5f1c8965e748c150d580a2ea8fbee1bd80d07a24 upstream.
+
+ovl_create_temp() treats "workdir" as a parent in which it creates an
+object so it should use I_MUTEX_PARENT.
+
+Prior to the commit identified below the lock was taken by the caller
+which sometimes used I_MUTEX_PARENT and sometimes used I_MUTEX_NORMAL.
+The use of I_MUTEX_NORMAL was incorrect but unfortunately copied into
+ovl_create_temp().
+
+Note to backporters: This patch only applies after the last Fixes given
+below (post v6.16).  To fix the bug in v6.7 and later the
+inode_lock() call in ovl_copy_up_workdir() needs to nest using
+I_MUTEX_PARENT.
+
+Link: https://lore.kernel.org/all/67a72070.050a0220.3d72c.0022.GAE@google.com/
+Cc: stable@vger.kernel.org
+Reported-by: syzbot+7836a68852a10ec3d790@syzkaller.appspotmail.com
+Tested-by: syzbot+7836a68852a10ec3d790@syzkaller.appspotmail.com
+Fixes: c63e56a4a652 ("ovl: do not open/llseek lower file with upper sb_writers held")
+Fixes: d2c995581c7c ("ovl: Call ovl_create_temp() without lock held.")
+Signed-off-by: NeilBrown <neil@brown.name>
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/overlayfs/copy_up.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -780,7 +780,7 @@ static int ovl_copy_up_workdir(struct ov
+               return err;
+ 
+       ovl_start_write(c->dentry);
+-      inode_lock(wdir);
++      inode_lock_nested(wdir, I_MUTEX_PARENT);
+       temp = ovl_create_temp(ofs, c->workdir, &cattr);
+       inode_unlock(wdir);
+       ovl_end_write(c->dentry);

diff --git a/queue-6.12/series b/queue-6.12/series
index 47cfbe5302aebacf6395e8e286a420b3b1d33f1b..2da87b8fc1c266bede97d88dc75f130d5725442b 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -241,3 +241,4 @@ tracing-limit-access-to-parser-buffer-when-trace_get_user-failed.patch
 drm-i915-icl-tc-convert-aux-powered-warn-to-a-debug-message.patch
 compiler-remove-__addressable_asm-_str-again.patch
 drm-i915-icl-tc-cache-the-max-lane-count-value.patch
+ovl-use-i_mutex_parent-when-locking-parent-in-ovl_create_temp.patch