Re: [PATCH] ovl: reserve space for the casefolded name terminator

[Amir Goldstein]

On Wed, Oct 28, 2026 at 8:51 PM Hungyu Lin <dennylin0707@xxxxxxxxx> wrote:
>
> ovl_casefold() allocates NAME_MAX bytes and passes that capacity to
> utf8_casefold(), which also needs room for a terminating NUL. A valid
> name whose folded form is exactly NAME_MAX bytes therefore fails to
> fold, and ovl_fill_merge() falls back to comparing the original bytes.
>
> For example, when two casefolded layers contain directories named with
> 255 uppercase and lowercase ASCII letters respectively, readdir lists
> both names even though lookup treats them as the same directory. The
> same names merge correctly at 254 bytes.
>
> Reserve one additional byte in both the allocation and the folding
> capacity so that NAME_MAX-byte folded names use the canonical merge key.
>
> Fixes: ee95c5fc86dd ("ovl: Create ovl_casefold() to support casefolded strncmp()")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Hungyu Lin <dennylin0707@xxxxxxxxx>
> ---
>  fs/overlayfs/readdir.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
> index 7d6f7f6022eb..6113d690f8ad 100644
> --- a/fs/overlayfs/readdir.c
> +++ b/fs/overlayfs/readdir.c
> @@ -81,13 +81,13 @@ static int ovl_casefold(struct ovl_readdir_data *rdd, const char *str, int len,
>             name_is_dot_dotdot(str, len))
>                 return 0;
>
> -       cf_name = kmalloc(NAME_MAX, GFP_KERNEL);
> +       cf_name = kmalloc(NAME_MAX + 1, GFP_KERNEL);
>         if (!cf_name) {
>                 rdd->err = -ENOMEM;
>                 return -ENOMEM;
>         }
>
> -       cf_len = utf8_casefold(rdd->map, &qstr, cf_name, NAME_MAX);
> +       cf_len = utf8_casefold(rdd->map, &qstr, cf_name, NAME_MAX + 1);
>         if (cf_len > 0)
>                 *dst = cf_name;
>         else
> --
> 2.43.0
>

Queued for ovl-fixes

Thanks,
Amir.