CVE-2026-89767: ovl: fix double end_creating() on the casefold-mismatch path

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix double endcreating() on the casefold-mismatch path

ovlcreatereal() releases the new dentry twice when the casefold consistency check fails. The SIFDIR branch calls endcreating() and sets err, then falls through to the common out: label which calls endcreating() on the same dentry again:

case SIFDIR: newdentry = ovldomkdir(ofs, dir, newdentry, attr->mode); err = PTRERRORZERO(newdentry); if (!err && ofs->casefold != ovldentrycasefolded(newdentry)) { prwarnratelimited(...); endcreating(newdentry); / first / err = -EINVAL; } break; ... if (err) goto out; ... out: if (err) { endcreating(newdentry); / second, same dentry / return ERRPTR(err); }

endcreating() is enddirop(), which does inodeunlock() on the parent and dput() on the dentry, so the parent directory's irwsem is unlocked twice and the dentry is put twice. The second unlock releases a lock that is not held, which is what wedges every later creation under that parent, and the second dput() drops a reference that was never taken.

The branch was added by commit dfc7da402ccc ("ovl: Check for casefold consistency when creating new dentries") as a bare dput(), which already released the reference twice; commit fe497f0759e0 ("VFS: change vfsmkdir() to unlock on failure.") converted both sites to endcreating(), adding the double unlock.

This is reachable by an unprivileged user. The casefold consistency of the layers is validated at mount time in ovlparselayer(), and again on every lookup in ovllookupsingle(), but ofs->workdir is the internal "work" subdirectory created inside the user-supplied workdir, and that subdirectory is not re-checked. Marking it casefolded after the mount therefore makes every ovlcreatetemp() inherit the wrong state - and that path reaches ovlcreatereal() through ovlstartcreatingtemp(), which uses startcreating() with a generated name and so never runs the lookup-time check.

unshare -Urm mount -t tmpfs -o casefold=utf8-12.1.0 tmpfs mnt mkdir -p mnt/lower/d mnt/upper mnt/work mnt/merged mount -t overlay ovl -o lowerdir=mnt/lower,\ upperdir=mnt/upper,workdir=mnt/work mnt/merged chattr +F mnt/work/work mkdir mnt/merged/d/sub # directory copy-up

overlayfs: wrong inherited casefold (work/#5)

and the next copy-up blocks forever on the parent's irwsem:

mkdir D startcreating+0x65/0xb0 ovlstartcreatingtemp+0xb0/0xe0 [overlay] ovlcreatetemp+0xa3/0x1d0 [overlay] ovlcopyupone+0x1f1c/0x21c0 [overlay] ovlcopyupflags+0xf5/0x140 [overlay] ovlcreateobject+0xb7/0x220 [overlay] ovlmkdir+0x23/0x40 [overlay]

Drop the endcreating() from the branch and let out: own the cleanup, which is what every other error path in this function already does.