On Mon, 18 Nov 2024 at 19:54, Amir Goldstein <amir73il@xxxxxxxxx> wrote: > Can you analyse what went wrong with the reproducer? > How did we get to a state where lowerstack of parent > has a dentry which is !d_can_lookup? Theoretically we could still get a an S_ISDIR inode, because ovl_get_inode() doesn't look at the is_dir value that lookup found. I.e. lookup thinks it found a non-dir, but iget will create a dir because of the backing inode's type. AFAICS this can only happen if i_op->lookup is not set on S_ISDIR for the backing inode, which shouldn't happen on normal filesystems. Reproducer seems to use bfs, which *should* be normal, and bfs_iget certainly doesn't do anything weird in that case, so I still don't understand what is happening. In any case something like the following should filter out such weirdness: bool ovl_dentry_weird(struct dentry *dentry) { + if (!d_can_lookup(dentry) && !d_is_file(dentry) && !d_is_symlink(dentry)) + return true; + return dentry->d_flags & (DCACHE_NEED_AUTOMOUNT | Thanks, Miklos