Commit ae146bc1abde for kernel

commit ae146bc1abdeb4607abf2975b858c053024e8ac1
Author: Amir Goldstein <amir73il@gmail.com>
Date:   Mon Sep 21 12:40:13 2026 +0200

    ovl: fix UAF in ovl_do_mkdir() debug print

    ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir().
    Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on
    failure."), vfs_mkdir() calls end_creating() on the input dentry on
    failure and may replace it on success, so the post-call %pd can
    use-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled.

    Print the dentry before the call and only the result afterward.

    Reported-by: syzbot+ced26b784bf977d223dd@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=ced26b784bf977d223dd
    Fixes: fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure.")
    Signed-off-by: Amir Goldstein <amir73il@gmail.com>
    Link: https://patch.msgid.link/20260921104013.40475-1-amir73il@gmail.com
    Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index e0d8c6152e9f..7f3558372c59 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -254,8 +254,10 @@ static inline struct dentry *ovl_do_mkdir(struct ovl_fs *ofs,
 {
 	struct dentry *ret;

+	/* vfs_mkdir() drops @dentry on failure and may replace it on success */
+	pr_debug("mkdir(%pd2, 0%o)\n", dentry, mode);
 	ret = vfs_mkdir(ovl_upper_mnt_idmap(ofs), dir, dentry, mode, NULL);
-	pr_debug("mkdir(%pd2, 0%o) = %i\n", dentry, mode, PTR_ERR_OR_ZERO(ret));
+	pr_debug("...mkdir = %i\n", PTR_ERR_OR_ZERO(ret));
 	return ret;
 }