[PATCH] ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()

[PATCH] ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()

[Amir Goldstein]

From: NeilBrown <neil@brown.name>

commit 5f1c8965e748c150d580a2ea8fbee1bd80d07a24 upstream.

ovl_create_temp() treats "workdir" as a parent in which it creates an
object so it should use I_MUTEX_PARENT.

Prior to the commit identified below the lock was taken by the caller
which sometimes used I_MUTEX_PARENT and sometimes used I_MUTEX_NORMAL.
The use of I_MUTEX_NORMAL was incorrect but unfortunately copied into
ovl_create_temp().

Note to backporters: This patch only applies after the last Fixes given
below (post v6.16).  To fix the bug in v6.7 and later the
inode_lock() call in ovl_copy_up_workdir() needs to nest using
I_MUTEX_PARENT.

[Amir: backport to v6.16 when lock was taken by the callers]

Link: https://lore.kernel.org/all/67a72070.050a0220.3d72c.0022.GAE@google.com/
Cc: stable@vger.kernel.org
Reported-by: syzbot+7836a68852a10ec3d790@syzkaller.appspotmail.com
Tested-by: syzbot+7836a68852a10ec3d790@syzkaller.appspotmail.com
Fixes: c63e56a4a652 ("ovl: do not open/llseek lower file with upper sb_writers held")
Fixes: d2c995581c7c ("ovl: Call ovl_create_temp() without lock held.")
Signed-off-by: NeilBrown <neil@brown.name>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---
 fs/overlayfs/copy_up.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index d7310fcf38881..c2263148ff20a 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -779,7 +779,7 @@ static int ovl_copy_up_workdir(struct ovl_copy_up_ctx *c)
 		return err;
 
 	ovl_start_write(c->dentry);
-	inode_lock(wdir);
+	inode_lock_nested(wdir, I_MUTEX_PARENT);
 	temp = ovl_create_temp(ofs, c->workdir, &cattr);
 	inode_unlock(wdir);
 	ovl_end_write(c->dentry);
-- 
2.50.1

Re: [PATCH] ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()

[Amir Goldstein]

On Thu, Aug 21, 2025 at 3:43 PM Amir Goldstein <amir73il@gmail.com> wrote:
>
> From: NeilBrown <neil@brown.name>
>
> commit 5f1c8965e748c150d580a2ea8fbee1bd80d07a24 upstream.
>
> ovl_create_temp() treats "workdir" as a parent in which it creates an
> object so it should use I_MUTEX_PARENT.
>
> Prior to the commit identified below the lock was taken by the caller
> which sometimes used I_MUTEX_PARENT and sometimes used I_MUTEX_NORMAL.
> The use of I_MUTEX_NORMAL was incorrect but unfortunately copied into
> ovl_create_temp().
>
> Note to backporters: This patch only applies after the last Fixes given
> below (post v6.16).  To fix the bug in v6.7 and later the
> inode_lock() call in ovl_copy_up_workdir() needs to nest using
> I_MUTEX_PARENT.
>
> [Amir: backport to v6.16 when lock was taken by the callers]

Greg,

Forgot to mention stable version in subject line.
This should apply cleanly to 6.16.y and 6.12.y.

Thanks,
Amir.

>
> Link: https://lore.kernel.org/all/67a72070.050a0220.3d72c.0022.GAE@google.com/
> Cc: stable@vger.kernel.org
> Reported-by: syzbot+7836a68852a10ec3d790@syzkaller.appspotmail.com
> Tested-by: syzbot+7836a68852a10ec3d790@syzkaller.appspotmail.com
> Fixes: c63e56a4a652 ("ovl: do not open/llseek lower file with upper sb_writers held")
> Fixes: d2c995581c7c ("ovl: Call ovl_create_temp() without lock held.")
> Signed-off-by: NeilBrown <neil@brown.name>
> Signed-off-by: Amir Goldstein <amir73il@gmail.com>
> ---
>  fs/overlayfs/copy_up.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
> index d7310fcf38881..c2263148ff20a 100644
> --- a/fs/overlayfs/copy_up.c
> +++ b/fs/overlayfs/copy_up.c
> @@ -779,7 +779,7 @@ static int ovl_copy_up_workdir(struct ovl_copy_up_ctx *c)
>                 return err;
>
>         ovl_start_write(c->dentry);
> -       inode_lock(wdir);
> +       inode_lock_nested(wdir, I_MUTEX_PARENT);
>         temp = ovl_create_temp(ofs, c->workdir, &cattr);
>         inode_unlock(wdir);
>         ovl_end_write(c->dentry);
> --
> 2.50.1
>