Re: [PATCH RFC v2 38/42] fuse: refuse files on pseudo filesystems as passthrough backing files

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] fuse: file_check_backing() with FMODE_PATH on unverified ovl
  dentry fails open
--

commit 3377a8521784786f7f79c18bd3aafabd17e04633
Author: Christian Brauner <brauner@kernel.org>

fuse: refuse files on pseudo filesystems as passthrough backing files

This commit calls file_check_backing() in fuse_backing_open_file() to
reject regular files on pseudo filesystems when registering FUSE
passthrough backing files.

> diff --git a/fs/fuse/backing.c b/fs/fuse/backing.c
> index 8c21a8a74efb9..7527f3ecb90dc 100644
> --- a/fs/fuse/backing.c
> +++ b/fs/fuse/backing.c
> @@ -147,6 +147,10 @@ static int fuse_backing_open_file(struct fuse_conn *fc, struct fuse_backing *fb,
>  		if (inode->i_sb->s_stack_depth >= fc->max_stack_depth)
>  			return -ELOOP;
>  
> +		err = file_check_backing(file, FMODE_PATH, 0);
> +		if (err)
> +			return err;

[Severity: Medium]
Can calling file_check_backing() with FMODE_PATH on an O_PATH overlayfs
file trigger a WARN(1) in ovl_d_real() and fail open?

Unlike a normal open(), opening with O_PATH returns from do_dentry_open()
before calling ovl_open() -> ovl_verify_lowerdata().  When
file_check_backing() then calls d_real_inode(file->f_path.dentry),
ovl_d_real() runs ovl_verify_lowerdata() on the unverified dentry:

fs/overlayfs/super.c:ovl_d_real() {
    ...
	err = ovl_verify_lowerdata(dentry);
	if (err)
		goto bug;
	lower = ovl_dentry_lowerdata(dentry);
	if (!lower)
		goto bug;

real_lower:
	/* Handle recursion into stacked lower fs */
	return d_real(lower, type);

bug:
	WARN(1, "%s(%pd4, %d): real dentry not found\n", __func__, dentry, type);
	return dentry;
}

If ovl_verify_lowerdata() fails (for example, -ENOENT on a broken metacopy
redirect in a data-only lower layer, -EIO on verity failure, or -EINTR in
ovl_maybe_lookup_lowerdata()), ovl_d_real() hits the WARN(1) and returns
the overlayfs dentry itself.  Because the overlayfs superblock does not
have SB_I_PSEUDO set, file_check_backing() returns 0 and registers
fb->path; if the failure was transient, a later fuse_passthrough_open() ->
backing_file_open() -> vfs_open() -> ovl_open() can still resolve the
lower data dentry on a pseudo filesystem.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261114-work-loop-pseudo-v2-0-98639a2286fb@kernel.org?part=38