ovl: make sure that ovl_create_real() returns a hashed dentry

[ Upstream commit ad1423922781e6552f18d055a5742b1cff018cdc ]

e8bd877fb76bb9f3 ("ovl: fix possible double unlink") added a sanity
check of !d_unhashed(child) to try to verify that child dentry was not
unlinked while parent dir was unlocked.

This "was not unlink" check has a false positive result in the case of
casefolded parent dir, because in that case, ovl_create_temp() returns
an unhashed dentry after ovl_create_real() gets an unhashed dentry from
ovl_lookup_upper() and makes it positive.

To avoid returning unhashed dentry from ovl_create_temp(), let
ovl_create_real() lookup again after making the newdentry positive,
so it always returns a hashed positive dentry (or an error).

This fixes the error in ovl_parent_lock() in ovl_check_rename_whiteout()
after ovl_create_temp() and allows mount of overlayfs with casefolding
enabled layers.

Reported-by: André Almeida <andrealmeid@igalia.com>
Closes: https://lore.kernel.org/r/18704e8c-c734-43f3-bc7c-b8be345e1bf5@igalia.com/
Suggested-by: Neil Brown <neil@brown.name>
Reviewed-by: Neil Brown <neil@brown.name>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index dbd63a74df4b1c87b70f29115dcb881f7a74d11b..039e829aa7dee839dcd99943feacf9f977d1692e 100644 (file)
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -205,12 +205,32 @@ struct dentry *ovl_create_real(struct ovl_fs *ofs, struct dentry *parent,
                        err = -EPERM;
                }
        }
-       if (!err && WARN_ON(!newdentry->d_inode)) {
+       if (err)
+               goto out;
+
+       if (WARN_ON(!newdentry->d_inode)) {
                /*
                 * Not quite sure if non-instantiated dentry is legal or not.
                 * VFS doesn't seem to care so check and warn here.
                 */
                err = -EIO;
+       } else if (d_unhashed(newdentry)) {
+               struct dentry *d;
+               /*
+                * Some filesystems (i.e. casefolded) may return an unhashed
+                * negative dentry from the ovl_lookup_upper() call before
+                * ovl_create_real().
+                * In that case, lookup again after making the newdentry
+                * positive, so ovl_create_upper() always returns a hashed
+                * positive dentry.
+                */
+               d = ovl_lookup_upper(ofs, newdentry->d_name.name, parent,
+                                    newdentry->d_name.len);
+               dput(newdentry);
+               if (IS_ERR_OR_NULL(d))
+                       err = d ? PTR_ERR(d) : -ENOENT;
+               else
+                       return d;
        }
 out:
        if (err) {