Re: [PATCH v2 1/3] ovl: disable nfs_export for same-sb lower layers with different idmaps

[Amir Goldstein <amir73il@gmail.com>]

On Sun, Nov 08, 2026 at 08:12:49PM +0100, Jérémy Jean wrote:
> On 2026-09-25 16:17, Amir Goldstein wrote:
> > On Fri, Sep 25, 2026 at 3:51 PM Christian Brauner <brauner@kernel.org>
> > wrote:
> > > 
> > > On Mon, Sep 21, 2026 at 10:10:28AM +0200, Amir Goldstein wrote:
> > > > On Sun, Sep 20, 2026 at 10:33 PM Jérémy Jean
> > > > <Jeremy.Jean@oss.cyber.gouv.fr> wrote:
> > > > >
> > > > > Overlay file handles identify a backing filesystem, but not the lower
> > > > > mount used to decode it. If lower layers share a superblock and use
> > > > > different idmaps, a file handle can decode through the wrong layer and
> > > > > initialize the overlay inode with the wrong owner.
> > > > >
> > > > > Track the first lower idmap seen for each ovl_sb and disable nfs_export
> > > > > when another lower layer on the same backing superblock uses a different
> > > > > idmap. Keep index enabled: copy up starts from the overlay dentry selected
> > > > > by lookup and does not need to decode a lower file handle through another
> > > > > layer.
> > > > >
> > > > > Fixes: bc70682a497c ("ovl: support idmapped layers")
> > > > > Assisted-by: Codex:gpt-5
> > > > > Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> > > > > ---
...
> > > > > +/*
> > > > > + * Lower file handles identify a lower fs, but not the mount whose idmap was
> > > > > + * used to decode them.  Remember the first lower idmap seen for each fs so
> > > > > + * decodable export handles can be disabled if another one appears.
> > > 
> > > I find this behavior counterintuitive. Shouldn't we just fail the
> > > mount then?
> > 
> > I would love to fail the mount if you confirm that setting up an ovl
> > with several
> > lower layers some on the same fs with different idmap, is a non-feature.
> > 
> > I don't know can't /home/amir and /home/brauner be on the same fs with
> > different idmapping?
> > 
> > Could it ever make sense to compose an overlay from two such
> > directories?
> > If not then I would gladly remove this setup from the test matrix.
> > 
> > Thanks,
> > Amir.
> 
> Hello,
> 
> I'm digging this up: should I investigate to prepare a new version that
> simply fails the mount?

Yes, please.

Thanks,
Amir.