FAILED: patch "[PATCH] ovl: fail the mount if the casefold flag has changed" failed to apply to 6.18-stable tree

FAILED: patch "[PATCH] ovl: fail the mount if the casefold flag has changed" failed to apply to 6.18-stable tree

[Sasha Levin]

The patch below does not apply to the 6.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y
git checkout FETCH_HEAD
git cherry-pick -x c782fc8ada811569811c0fdea5c3412511be95d0
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '20261109200525-failed-6.18-c782fc8ada81@kernel.org' --subject-prefix 'PATCH 6.18.y' 'HEAD^..'

Thanks,
Sasha

------------------ original commit in Linus's tree ------------------

From c782fc8ada811569811c0fdea5c3412511be95d0 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Fri, 16 Oct 2026 21:17:21 +0000
Subject: [PATCH] ovl: fail the mount if the casefold flag has changed

An unprivileged user in a user namespace can repeatedly trigger a kernel
warning with their own overlay mounts. They do so by changing the
casefold flag of the topmost layer's empty root, the top directory of
that layer, after the layers are set and before the mount is created.

The casefold flag of a directory makes name lookups in that directory
case-insensitive. All layers of an overlay must agree on casefolding.

ovl_mount_dir_check() reads the casefold flag of a layer root when
fsconfig() sets that layer, and saves the result in ofs->casefold. The
mount is created later, by another fsconfig() call with
FSCONFIG_CMD_CREATE.

The casefold flag of an empty directory can be changed.

The casefold flag of the overlay root must match ofs->casefold.
ovl_get_root() copies the flag from the topmost layer root, as it is
when the mount is created. On a mismatch, ovl_get_root() only does a
WARN_ON(), and the mount continues. The check is not a WARN_ON_ONCE(),
so each such mount warns again.

An unprivileged user needs CONFIG_UNICODE, and a tmpfs mounted with the
casefold option in their namespace.

Reproduced by changing the casefold flag of the empty upper directory
after the layers were set and before FSCONFIG_CMD_CREATE, with tmpfs and
ext4 layers, and as uid 1000 in a user namespace.

Fix this by replacing the WARN_ON() with a check that fails the mount
with -EINVAL.

Fixes: f9377faaeae0 ("ovl: Add S_CASEFOLD as part of the inode flag to be copied")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Tested-by: Hungyu Lin <dennylin0707@gmail.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---
 fs/overlayfs/super.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index d9174eaccce2d..8bc970748b96b 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1387,7 +1387,6 @@ static struct dentry *ovl_get_root(struct super_block *sb,
 	ovl_dentry_set_flag(OVL_E_CONNECTED, root);
 	ovl_set_upperdata(d_inode(root));
 	ovl_inode_init(d_inode(root), &oip, ino, fsid);
-	WARN_ON(!!IS_CASEFOLDED(d_inode(root)) != ofs->casefold);
 	ovl_dentry_init_flags(root, upperdentry, oe, DCACHE_OP_WEAK_REVALIDATE);
 	/* root keeps a reference of upperdentry */
 	dget(upperdentry);
@@ -1571,6 +1570,17 @@ static int ovl_fill_super_creds(struct fs_context *fc, struct super_block *sb)
 	if (!sb->s_root)
 		goto out_free_oe;
 
+	/*
+	 * The casefold flag of an empty layer root may have changed since the
+	 * mount options were parsed.  The root inode owns oe by now.
+	 */
+	if (!!IS_CASEFOLDED(d_inode(sb->s_root)) != ofs->casefold) {
+		pr_err("casefold flag of the root directory has changed\n");
+		dput(sb->s_root);
+		sb->s_root = NULL;
+		return -EINVAL;
+	}
+
 	return 0;
 
 out_free_oe:
-- 
2.53.0

[PATCH 6.18.y] ovl: fail the mount if the casefold flag has changed

[Hungyu Lin]

From: Chris Mason <mason@kernel.org>

[ Upstream commit c782fc8ada811569811c0fdea5c3412511be95d0 ]

The casefold flag of the overlay root must match the flag recorded when
validating the layer roots. If these values disagree when creating the
root inode, fail the mount with -EINVAL instead of warning and allowing
the mount to continue.

In 6.18, ovl_fill_super() still owns the credentials and error cleanup.
Drop the local root dentry before publishing it and use out_err to
revert credentials and release the overlay state. The root inode
already owns the overlay entry, so bypass out_free_oe.

Fixes: f9377faaeae0 ("ovl: Add S_CASEFOLD as part of the inode flag to be copied")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Tested-by: Hungyu Lin <dennylin0707@gmail.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 fs/overlayfs/super.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 8d4ef5b..52d6f32 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1370,7 +1370,6 @@ static struct dentry *ovl_get_root(struct super_block *sb,
 	ovl_dentry_set_flag(OVL_E_CONNECTED, root);
 	ovl_set_upperdata(d_inode(root));
 	ovl_inode_init(d_inode(root), &oip, ino, fsid);
-	WARN_ON(!!IS_CASEFOLDED(d_inode(root)) != ofs->casefold);
 	ovl_dentry_init_flags(root, upperdentry, oe, DCACHE_OP_WEAK_REVALIDATE);
 	/* root keeps a reference of upperdentry */
 	dget(upperdentry);
@@ -1576,6 +1575,17 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc)
 	if (!root_dentry)
 		goto out_free_oe;
 
+	/*
+	 * The casefold flag of an empty layer root may have changed since the
+	 * mount options were parsed. The root inode owns oe by now.
+	 */
+	if (!!IS_CASEFOLDED(d_inode(root_dentry)) != ofs->casefold) {
+		pr_err("casefold flag of the root directory has changed\n");
+		dput(root_dentry);
+		err = -EINVAL;
+		goto out_err;
+	}
+
 	sb->s_root = root_dentry;
 
 	ovl_revert_creds(old_cred);
-- 
2.50.1 (Apple Git-155)

Re: [PATCH 6.18.y] ovl: fail the mount if the casefold flag has changed

[Amir Goldstein]

On Thu, Nov 12, 2026 at 9:43 AM Hungyu Lin <dennylin0707@gmail.com> wrote:
>
> From: Chris Mason <mason@kernel.org>
>
> [ Upstream commit c782fc8ada811569811c0fdea5c3412511be95d0 ]
>
> The casefold flag of the overlay root must match the flag recorded when
> validating the layer roots. If these values disagree when creating the
> root inode, fail the mount with -EINVAL instead of warning and allowing
> the mount to continue.
>

What happened to the original commit message?

> In 6.18, ovl_fill_super() still owns the credentials and error cleanup.
> Drop the local root dentry before publishing it and use out_err to
> revert credentials and release the overlay state. The root inode
> already owns the overlay entry, so bypass out_free_oe.

This is better placed just before your signed-off line
inside [backport: ...] or [hungyu: ...] comment

to preserve the context of the original commit message
and to make it clearer what changed in stable and who signed off on what

Thanks,
Amir.

>
> Fixes: f9377faaeae0 ("ovl: Add S_CASEFOLD as part of the inode flag to be copied")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chris Mason <mason@kernel.org>
> Tested-by: Hungyu Lin <dennylin0707@gmail.com>
> Signed-off-by: Amir Goldstein <amir73il@gmail.com>
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
> ---
>  fs/overlayfs/super.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
> index 8d4ef5b..52d6f32 100644
> --- a/fs/overlayfs/super.c
> +++ b/fs/overlayfs/super.c
> @@ -1370,7 +1370,6 @@ static struct dentry *ovl_get_root(struct super_block *sb,
>         ovl_dentry_set_flag(OVL_E_CONNECTED, root);
>         ovl_set_upperdata(d_inode(root));
>         ovl_inode_init(d_inode(root), &oip, ino, fsid);
> -       WARN_ON(!!IS_CASEFOLDED(d_inode(root)) != ofs->casefold);
>         ovl_dentry_init_flags(root, upperdentry, oe, DCACHE_OP_WEAK_REVALIDATE);
>         /* root keeps a reference of upperdentry */
>         dget(upperdentry);
> @@ -1576,6 +1575,17 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc)
>         if (!root_dentry)
>                 goto out_free_oe;
>
> +       /*
> +        * The casefold flag of an empty layer root may have changed since the
> +        * mount options were parsed. The root inode owns oe by now.
> +        */
> +       if (!!IS_CASEFOLDED(d_inode(root_dentry)) != ofs->casefold) {
> +               pr_err("casefold flag of the root directory has changed\n");
> +               dput(root_dentry);
> +               err = -EINVAL;
> +               goto out_err;
> +       }
> +
>         sb->s_root = root_dentry;
>
>         ovl_revert_creds(old_cred);
> --
> 2.50.1 (Apple Git-155)
>