Re: [PATCH] ovl: reserve space for the casefolded name terminator

["André Almeida" <andrealmeid@igalia.com>]

Hi Hungyu, Amir,

Sorry for the delay and thanks for the patch!

Em 28/10/2026 16:51, Hungyu Lin escreveu:
> ovl_casefold() allocates NAME_MAX bytes and passes that capacity to
> utf8_casefold(), which also needs room for a terminating NUL. A valid
> name whose folded form is exactly NAME_MAX bytes therefore fails to
> fold, and ovl_fill_merge() falls back to comparing the original bytes.
> 
> For example, when two casefolded layers contain directories named with
> 255 uppercase and lowercase ASCII letters respectively, readdir lists
> both names even though lookup treats them as the same directory. The
> same names merge correctly at 254 bytes.
> 
> Reserve one additional byte in both the allocation and the folding
> capacity so that NAME_MAX-byte folded names use the canonical merge key.
> 
> Fixes: ee95c5fc86dd ("ovl: Create ovl_casefold() to support casefolded strncmp()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>

Reviewed-by: André Almeida <andrealmeid@igalia.com>

I've tested and confirmed that files with 255 filenames will appear 
duplicated.

> ---
>   fs/overlayfs/readdir.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
> index 7d6f7f6022eb..6113d690f8ad 100644
> --- a/fs/overlayfs/readdir.c
> +++ b/fs/overlayfs/readdir.c
> @@ -81,13 +81,13 @@ static int ovl_casefold(struct ovl_readdir_data *rdd, const char *str, int len,
>   	    name_is_dot_dotdot(str, len))
>   		return 0;
>   
> -	cf_name = kmalloc(NAME_MAX, GFP_KERNEL);
> +	cf_name = kmalloc(NAME_MAX + 1, GFP_KERNEL);
>   	if (!cf_name) {
>   		rdd->err = -ENOMEM;
>   		return -ENOMEM;
>   	}
>   
> -	cf_len = utf8_casefold(rdd->map, &qstr, cf_name, NAME_MAX);
> +	cf_len = utf8_casefold(rdd->map, &qstr, cf_name, NAME_MAX + 1);

I wonder if the other callers for utf8_casefold() also need a fix?

>   	if (cf_len > 0)
>   		*dst = cf_name;
>   	else