Re: overlayfs: verity validation broken since f77f281b6118

["Colin Walters" <walters@verbum.org>]

On Tue, May 5, 2026, at 2:07 PM, Andrey Albershteyn wrote:
> On 2026-05-01 11:07:25, Eric Biggers wrote:
>> [+Cc fsverity@lists.linux.dev]
>> 
>> On Fri, May 01, 2026 at 01:14:54PM -0400, Colin Walters wrote:
>> > Hi Christoph & Eric,
>> > 
>> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f77f281b6118 broke composefs's usage of overlayfs verity=require, this was reported originally in https://github.com/bootc-dev/bootc/issues/2174
>> > 
>> > There's some output from an agent run I had in the <details> there, but here's an xfstests patch that passes on without that commit and fails with it.
>> > 
>> > From 14231122bfd1e41337e4fb847acbbe038457c32a Mon Sep 17 00:00:00 2001
>> > From: Colin Walters <walters@verbum.org>
>> > Date: Fri, 1 May 2026 09:45:58 -0400
>> > Subject: [PATCH] overlay/118: test fsverity lazy load through metacopy overlay
>> > 
>> > Reproduces the regression reported at:
>> > https://github.com/bootc-dev/bootc/issues/2174
>> > 
>> > A recent change in how fsverity state was cached in memory
>> > I think caused inodes not in cache to appear to have
>> > missing verity=require for overlayfs.
>> > 
>> > This test catches that.
>> > 
>> > Generated-by: OpenCode (Claude Sonnet 4.5)
>> > Signed-off-by: Colin Walters <walters@verbum.org>
>> 
>> Sorry about that.  I guess it's because the semantics of
>> fsverity_active() changed to be basically the same as IS_VERITY(), and
>> that broke ovl_ensure_verity_loaded() which does
>> '!fsverity_active(inode) && IS_VERITY(inode)'.  I guess now it should
>> do: IS_VERITY(inode) && fsverity_get_info(inode) == NULL.
>> 
>> - Eric
>> 
>
> I guess this could be also fixed by patch 2 and 3 from my XFS
> fsverity support [1]
>
> 1: 
> https://lore.kernel.org/fsverity/20260428083332.768693-1-aalbersh@kernel.org/T/#t

Yes, definitely similar. My draft went even farther - personally I like not having ovl_ensure_verity_loaded at all. But in the end I don't have a really strong opinion on that, as long as we get the xfstest merged so there's less chance of future regressions I'm happy!