[PATCH] ovl: fix verity lazy-load guard broken by fsverity_active() semantic change

[PATCH] ovl: fix verity lazy-load guard broken by fsverity_active() semantic change

[Colin Walters]

Commit f77f281b6118 ("fsverity: use a hashtable to find the fsverity_info")
that broke `ovl_ensure_verity_loaded` in the case when the inode was not in core.

The APIs here are in my opinion now confusing, but this patch intentionally
aims for a minimized fix by using `fsverity_get_info()` which ensures
the hash table is loaded.

Fixes: f77f281b6118 ("fsverity: use a hashtable to find the fsverity_info")
Cc: stable@vger.kernel.org
Link: https://github.com/bootc-dev/bootc/issues/2174
Signed-off-by: Colin Walters <walters@verbum.org>
---
 fs/overlayfs/util.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index 7b86a6bac644..bfdf9310ee78 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -1354,7 +1354,7 @@ int ovl_ensure_verity_loaded(const struct path *datapath)
 	struct inode *inode = d_inode(datapath->dentry);
 	struct file *filp;
 
-	if (!fsverity_active(inode) && IS_VERITY(inode)) {
+	if (IS_VERITY(inode) && !fsverity_get_info(inode)) {
 		/*
 		 * If this inode was not yet opened, the verity info hasn't been
 		 * loaded yet, so we need to do that here to force it into memory.
-- 
2.52.0

Re: [PATCH] ovl: fix verity lazy-load guard broken by fsverity_active() semantic change

[Eric Biggers]

On Tue, May 05, 2026 at 02:15:58PM -0400, Colin Walters wrote:
> Commit f77f281b6118 ("fsverity: use a hashtable to find the fsverity_info")
> that broke `ovl_ensure_verity_loaded` in the case when the inode was not in core.
> 
> The APIs here are in my opinion now confusing, but this patch intentionally
> aims for a minimized fix by using `fsverity_get_info()` which ensures
> the hash table is loaded.
> 
> Fixes: f77f281b6118 ("fsverity: use a hashtable to find the fsverity_info")
> Cc: stable@vger.kernel.org
> Link: https://github.com/bootc-dev/bootc/issues/2174
> Signed-off-by: Colin Walters <walters@verbum.org>

Reviewed-by: Eric Biggers <ebiggers@kernel.org>

I can take this through the fsverity tree as a fix for 7.1.  Amir, let
me know if you'd prefer to take it instead.

- Eric

Re: [PATCH] ovl: fix verity lazy-load guard broken by fsverity_active() semantic change

[Eric Biggers]

On Tue, May 05, 2026 at 02:00:16PM -0700, Eric Biggers wrote:
> On Tue, May 05, 2026 at 02:15:58PM -0400, Colin Walters wrote:
> > Commit f77f281b6118 ("fsverity: use a hashtable to find the fsverity_info")
> > that broke `ovl_ensure_verity_loaded` in the case when the inode was not in core.
> > 
> > The APIs here are in my opinion now confusing, but this patch intentionally
> > aims for a minimized fix by using `fsverity_get_info()` which ensures
> > the hash table is loaded.
> > 
> > Fixes: f77f281b6118 ("fsverity: use a hashtable to find the fsverity_info")
> > Cc: stable@vger.kernel.org
> > Link: https://github.com/bootc-dev/bootc/issues/2174
> > Signed-off-by: Colin Walters <walters@verbum.org>
> 
> Reviewed-by: Eric Biggers <ebiggers@kernel.org>
> 
> I can take this through the fsverity tree as a fix for 7.1.  Amir, let
> me know if you'd prefer to take it instead.

I'll take this fix, but reading the commit message again, the
explanation makes no sense.  The issue has nothing to do with whether
the *inode* is in core or not.  And we aren't "loading a hash table".
The change in the order that we do the checks isn't mentioned, either.

I sent a v2 with an explanation that is much clearer, IMO.

I'll apply that version if there isn't any objection.

- Eric