FAILED: patch "[PATCH] ovl: use the pinned upper dir in ovl_fix_origin()" failed to apply to 6.1-stable tree

FAILED: patch "[PATCH] ovl: use the pinned upper dir in ovl_fix_origin()" failed to apply to 6.1-stable tree

[gregkh]

The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 4f61ff2ebfb3d2967b83b6a4d456242244d5a61f
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026110427-yam-conjoined-4ce6@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 4f61ff2ebfb3d2967b83b6a4d456242244d5a61f Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Wed, 7 Oct 2026 10:47:10 +0000
Subject: [PATCH] ovl: use the pinned upper dir in ovl_fix_origin()

Renames made directly on the upper filesystem during a lookup crash the
kernel.

A dentry that is passed to vfs_setxattr() must be pinned.
ovl_fix_origin() passes upper->d_parent to ovl_set_impure() without a
reference, and the lookup holds no lock of the upper directory. A
rename on the upper filesystem changes d_parent, and only the child
pins the new parent, so a second rename and an rmdir free it.

With delays in ovl_fix_origin() and ovl_set_impure(), renaming the upper
directory twice and removing the intermediate parent during the lookup
of a merge directory without an origin xattr gave a KASAN
use-after-free in vfs_setxattr().

Fix this by passing the upper dentry that the overlay parent holds.

Fixes: 9678e6303057 ("ovl: fix inconsistent d_ino for legacy merge dir")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[amir: add helper ovl_set_impure_dir()]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>

diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index ca899fdfaafd..cf7908a39f61 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -942,8 +942,10 @@ static int ovl_fix_origin(struct ovl_fs *ofs, struct dentry *dentry,
 		goto out;
 
 	err = ovl_set_origin_fh(ofs, fh, upper);
-	if (!err)
-		err = ovl_set_impure(dentry->d_parent, upper->d_parent);
+	if (!err) {
+		/* upper->d_parent is not stable, use the overlay parent */
+		err = ovl_set_impure_dir(dentry->d_parent);
+	}
 
 	ovl_drop_write(dentry);
 out:
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index 7f3558372c59..c89739e5338b 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -572,6 +572,12 @@ int ovl_check_setxattr(struct ovl_fs *ofs, struct dentry *upperdentry,
 		       enum ovl_xattr ox, const void *value, size_t size,
 		       int xerr);
 int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry);
+
+static inline int ovl_set_impure_dir(struct dentry *dentry)
+{
+	return ovl_set_impure(dentry, ovl_dentry_upper(dentry));
+}
+
 bool ovl_inuse_trylock(struct dentry *dentry);
 void ovl_inuse_unlock(struct dentry *dentry);
 bool ovl_is_inuse(struct dentry *dentry);

[PATCH 6.1.y] ovl: use the pinned upper dir in ovl_fix_origin()

[Sasha Levin]

From: Chris Mason <mason@kernel.org>

[ Upstream commit 4f61ff2ebfb3d2967b83b6a4d456242244d5a61f ]

Renames made directly on the upper filesystem during a lookup crash the
kernel.

A dentry that is passed to vfs_setxattr() must be pinned.
ovl_fix_origin() passes upper->d_parent to ovl_set_impure() without a
reference, and the lookup holds no lock of the upper directory. A
rename on the upper filesystem changes d_parent, and only the child
pins the new parent, so a second rename and an rmdir free it.

With delays in ovl_fix_origin() and ovl_set_impure(), renaming the upper
directory twice and removing the intermediate parent during the lookup
of a merge directory without an origin xattr gave a KASAN
use-after-free in vfs_setxattr().

Fix this by passing the upper dentry that the overlay parent holds.

Fixes: 9678e6303057 ("ovl: fix inconsistent d_ino for legacy merge dir")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[amir: add helper ovl_set_impure_dir()]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
[ sashal: replaced ovl_set_impure_dir() with a direct ovl_set_impure(parent, ovl_dentry_upper(parent)) call to avoid adding a helper ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/overlayfs/namei.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index cb8ca730c0ecf..f144fe91ccbf5 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -819,8 +819,11 @@ static int ovl_fix_origin(struct ovl_fs *ofs, struct dentry *dentry,
 		return err;
 
 	err = ovl_set_origin(ofs, lower, upper);
-	if (!err)
-		err = ovl_set_impure(dentry->d_parent, upper->d_parent);
+	if (!err) {
+		/* upper->d_parent is not stable, use the overlay parent */
+		err = ovl_set_impure(dentry->d_parent,
+				     ovl_dentry_upper(dentry->d_parent));
+	}
 
 	ovl_drop_write(dentry);
 	return err;
-- 
2.53.0

Re: [PATCH 6.1.y] ovl: use the pinned upper dir in ovl_fix_origin()

[Amir Goldstein]

On Thu, Nov 5, 2026 at 4:44 AM Sasha Levin <sashal@kernel.org> wrote:
>
> From: Chris Mason <mason@kernel.org>
>
> [ Upstream commit 4f61ff2ebfb3d2967b83b6a4d456242244d5a61f ]
>
> Renames made directly on the upper filesystem during a lookup crash the
> kernel.
>
> A dentry that is passed to vfs_setxattr() must be pinned.
> ovl_fix_origin() passes upper->d_parent to ovl_set_impure() without a
> reference, and the lookup holds no lock of the upper directory. A
> rename on the upper filesystem changes d_parent, and only the child
> pins the new parent, so a second rename and an rmdir free it.
>
> With delays in ovl_fix_origin() and ovl_set_impure(), renaming the upper
> directory twice and removing the intermediate parent during the lookup
> of a merge directory without an origin xattr gave a KASAN
> use-after-free in vfs_setxattr().
>
> Fix this by passing the upper dentry that the overlay parent holds.
>
> Fixes: 9678e6303057 ("ovl: fix inconsistent d_ino for legacy merge dir")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chris Mason <mason@kernel.org>
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> [amir: add helper ovl_set_impure_dir()]
> Signed-off-by: Amir Goldstein <amir73il@gmail.com>
> [ sashal: replaced ovl_set_impure_dir() with a direct ovl_set_impure(parent, ovl_dentry_upper(parent)) call to avoid adding a helper ]
> Signed-off-by: Sasha Levin <sashal@kernel.org>

Why avoid adding a helper?
This just makes LTS out of sync with upstream and future backports.

I dare to say this is not your doing but AI, because you should have
known better.

Anyway, this version also strays from 6.6 version which I asked Greg
to apply to 6.1:

https://lore.kernel.org/stable/20261104184559.3630145-1-amir73il@gmail.com/

Thanks,
Amir.


> ---
>  fs/overlayfs/namei.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
> index cb8ca730c0ecf..f144fe91ccbf5 100644
> --- a/fs/overlayfs/namei.c
> +++ b/fs/overlayfs/namei.c
> @@ -819,8 +819,11 @@ static int ovl_fix_origin(struct ovl_fs *ofs, struct dentry *dentry,
>                 return err;
>
>         err = ovl_set_origin(ofs, lower, upper);
> -       if (!err)
> -               err = ovl_set_impure(dentry->d_parent, upper->d_parent);
> +       if (!err) {
> +               /* upper->d_parent is not stable, use the overlay parent */
> +               err = ovl_set_impure(dentry->d_parent,
> +                                    ovl_dentry_upper(dentry->d_parent));
> +       }
>
>         ovl_drop_write(dentry);
>         return err;
> --
> 2.53.0
>

Re: [PATCH 6.1.y] ovl: use the pinned upper dir in ovl_fix_origin()

[Sasha Levin]

> Anyway, this version also strays from 6.6 version which I asked Greg
> to apply to 6.1

Agreed. I took your 6.6 pair for 6.1 instead of my versions.

-- 
Thanks,
Sasha