[PATCH] ovl: reject verity= together with userxattr

[Tao Cui]

From: Tao Cui <cuitao@xxxxxxxxxx>

userxattr forces metacopy off, and copy-up only computes and stores
the verity digest for metacopy inodes.  With "userxattr,verity=on"
(or verity=require) the mount succeeds, verity is advertised in
mountinfo, but no digest is ever generated and no lowerdata is ever
verified - the option silently does nothing:

  $ mount -t overlay ovl -o lowerdir=$l,upperdir=$u,workdir=$w,userxattr,verity=on /mnt
  (mount succeeds; after copy-up the upper inode carries only the
   origin xattr, no metacopy xattr, no digest)

Follow the existing pattern for redirect_dir/metacopy and reject the
explicit combination at parse time:

  $ mount -t overlay ovl -o lowerdir=$l,upperdir=$u,workdir=$w,userxattr,verity=on /mnt
  mount: /mnt: wrong fs type, bad option, bad superblock...
  overlayfs: conflicting options: userxattr,verity=on

This does not affect per-file fs-verity on the lower layers used
together with userxattr (e.g. fstests overlay/089): it only concerns
the verity= mount option, whose copy-up digest semantics cannot be
honored when userxattr forces metacopy off.

Signed-off-by: Tao Cui <cuitao@xxxxxxxxxx>
---
 fs/overlayfs/params.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
index c93fcaa45d4a..29dfc16fecc9 100644
--- a/fs/overlayfs/params.c
+++ b/fs/overlayfs/params.c
@@ -997,6 +997,11 @@ int ovl_fs_params_verify(const struct ovl_fs_context *ctx,
 			pr_err("conflicting options: userxattr,metacopy=on\n");
 			return -EINVAL;
 		}
+		if (config->verity_mode) {
+			pr_err("conflicting options: userxattr,verity=%s\n",
+			       ovl_verity_mode(config));
+			return -EINVAL;
+		}
 		/*
 		 * Silently disable default setting of redirect and metacopy.
 		 * This shall be the default in the future as well: these
-- 
2.43.0