Patch "ovl: check type and offset of struct vfsmount in ovl_entry" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ovl: check type and offset of struct vfsmount in ovl_entry

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ovl-check-type-and-offset-of-struct-vfsmount-in-ovl_.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 26bf0503e78fceb46d0d9ef8270ba2a77e945053
Author: Christian Brauner <brauner@xxxxxxxxxx>
Date:   Tue Jun 13 10:13:37 2023 +0200

    ovl: check type and offset of struct vfsmount in ovl_entry
    
    [ Upstream commit f723edb8a532cd26e1ff0a2b271d73762d48f762 ]
    
    Porting overlayfs to the new amount api I started experiencing random
    crashes that couldn't be explained easily. So after much debugging and
    reasoning it became clear that struct ovl_entry requires the point to
    struct vfsmount to be the first member and of type struct vfsmount.
    
    During the port I added a new member at the beginning of struct
    ovl_entry which broke all over the place in the form of random crashes
    and cache corruptions. While there's a comment in ovl_free_fs() to the
    effect of "Hack! Reuse ofs->layers as a vfsmount array before freeing
    it" there's no such comment on struct ovl_entry which makes this easy to
    trip over.
    
    Add a comment and two static asserts for both the offset and the type of
    pointer in struct ovl_entry.
    
    Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx>
    Signed-off-by: Amir Goldstein <amir73il@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h
index b2d64f3c974bb..08031638bbeec 100644
--- a/fs/overlayfs/ovl_entry.h
+++ b/fs/overlayfs/ovl_entry.h
@@ -32,6 +32,7 @@ struct ovl_sb {
 };
 
 struct ovl_layer {
+	/* ovl_free_fs() relies on @mnt being the first member! */
 	struct vfsmount *mnt;
 	/* Trap in ovl inode cache */
 	struct inode *trap;
@@ -42,6 +43,14 @@ struct ovl_layer {
 	int fsid;
 };
 
+/*
+ * ovl_free_fs() relies on @mnt being the first member when unmounting
+ * the private mounts created for each layer. Let's check both the
+ * offset and type.
+ */
+static_assert(offsetof(struct ovl_layer, mnt) == 0);
+static_assert(__same_type(typeof_member(struct ovl_layer, mnt), struct vfsmount *));
+
 struct ovl_path {
 	const struct ovl_layer *layer;
 	struct dentry *dentry;