[GIT PULL 16/18 for v7.3] vfs ovl

Hey Linus,

/* Summary */

This lets the merged overlayfs mount itself be idmapped through
mount_setattr(MOUNT_ATTR_IDMAP). In addition to the already supported
idmapped lower and upper layers. The same overlay tree can then be
exposed under a different ownership view.

Overlayfs already normalizes every underlying id through the relevant
layer idmap when ovl_copyattr() copies attributes into the overlay
inode. So the overlay inode's i_uid and i_gid are overlay-final ids.

The overlay mount idmap composes on top of that and is applied at the
overlay-inode boundary only while the underlying layers keep being
accessed with the mounter's credentials through their own (possibly
idmapped) mounts.

So this only changes how the caller sees the overlay inode and never
widens the mounter's access to the layers. The second,
mounter-credential check in ovl_permission() against the real inode
stays on the layer idmap.

Most paths need no change because the VFS applies the mount idmap to
the overlay inode before overlayfs runs or after it returns at the
syscall boundary. Overlayfs only has to change where it bypasses the
generic path.

This also included is a fix for a double end_creating() on the overlayfs
casefold-mismatch path.

/* Testing */

No build failures or warnings were observed.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit dc59e4fea9d83f03bad6bddf3fa2e52491777482:

  Linux 7.2-rc1 (2026-06-28 12:01:31 -0700)

are available in the Git repository at:

  [email protected]:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.3-rc1.ovl

for you to fetch changes up to 077ab8985ee278c3d8618182d335b0f0cd919e16:

  ovl: fix double end_creating() on the casefold-mismatch path (2026-08-12 11:40:35 +0200)

----------------------------------------------------------------
vfs-7.3-rc1.ovl

Please consider pulling these changes from the signed vfs-7.3-rc1.ovl tag.

Thanks!
Christian

----------------------------------------------------------------
Christian Brauner (11):
      ovl: handle idmapped mounts in ovl_create_object() and ovl_tmpfile()
      ovl: handle idmapped mounts in ovl_permission()
      ovl: handle idmapped mounts in ovl_setattr()
      ovl: handle idmapped mounts in ovl_getattr()
      ovl: handle idmapped mounts in ovl_set_acl()
      ovl: allow idmapping overlay mounts
      docs: document idmapped overlay mounts
      selftests/filesystems/overlayfs: fix set_layers_via_fds link error
      selftests/filesystems/overlayfs: test idmapped overlay mounts
      ovl: document security.capability idmapping on the xattr forward paths
      Merge patch series "ovl: support idmapped overlay mounts"

Vivek Parikh (1):
      ovl: fix double end_creating() on the casefold-mismatch path

 Documentation/filesystems/overlayfs.rst            |  16 +
 fs/overlayfs/dir.c                                 |  17 +-
 fs/overlayfs/inode.c                               |  26 +-
 fs/overlayfs/overlayfs.h                           |   1 +
 fs/overlayfs/super.c                               |   2 +-
 fs/overlayfs/xattrs.c                              |   1 +
 .../selftests/filesystems/overlayfs/.gitignore     |   1 +
 .../selftests/filesystems/overlayfs/Makefile       |   2 +
 .../filesystems/overlayfs/idmapped_mounts.c        | 501 +++++++++++++++++++++
 .../filesystems/overlayfs/set_layers_via_fds.c     |  16 +-
 10 files changed, 560 insertions(+), 23 deletions(-)
 create mode 100644 tools/testing/selftests/filesystems/overlayfs/idmapped_mounts.c