Re: overlayfs: verity validation broken since f77f281b6118

On 2026-05-01 11:07:25, Eric Biggers wrote:
> [+Cc [email protected]]
> 
> On Fri, May 01, 2026 at 01:14:54PM -0400, Colin Walters wrote:
> > Hi Christoph & Eric,
> > 
> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f77f281b6118 broke composefs's usage of overlayfs verity=require, this was reported originally in https://github.com/bootc-dev/bootc/issues/2174
> > 
> > There's some output from an agent run I had in the <details> there, but here's an xfstests patch that passes on without that commit and fails with it.
> > 
> > From 14231122bfd1e41337e4fb847acbbe038457c32a Mon Sep 17 00:00:00 2001
> > From: Colin Walters <[email protected]>
> > Date: Fri, 1 May 2026 09:45:58 -0400
> > Subject: [PATCH] overlay/118: test fsverity lazy load through metacopy overlay
> > 
> > Reproduces the regression reported at:
> > https://github.com/bootc-dev/bootc/issues/2174
> > 
> > A recent change in how fsverity state was cached in memory
> > I think caused inodes not in cache to appear to have
> > missing verity=require for overlayfs.
> > 
> > This test catches that.
> > 
> > Generated-by: OpenCode (Claude Sonnet 4.5)
> > Signed-off-by: Colin Walters <[email protected]>
> 
> Sorry about that.  I guess it's because the semantics of
> fsverity_active() changed to be basically the same as IS_VERITY(), and
> that broke ovl_ensure_verity_loaded() which does
> '!fsverity_active(inode) && IS_VERITY(inode)'.  I guess now it should
> do: IS_VERITY(inode) && fsverity_get_info(inode) == NULL.
> 
> - Eric
> 

I guess this could be also fixed by patch 2 and 3 from my XFS
fsverity support [1]

1: https://lore.kernel.org/fsverity/[email protected]/T/#t

-- 
- Andrey