Overlayfs security fixes land; Linus rewrites VFS name helper

Amir Goldstein's overlayfs fixes for Linux 7.3 have been merged, closing several bugs reachable by unprivileged users: an information leak, a use-after-free, and a NULL pointer dereference. Chris Mason's AI-assisted review found many of them, along with an RCU walk stall involving remote layers and data loss when nfs_export is enabled.

The pull also stops copy-up from being blocked by an empty security.capability extended attribute that any user could set, repairs a regression with the override_creds mount option introduced in 6.16, and corrects casefold checks so only directories are examined.

Linus Torvalds pulled the series but rejected the approach of a new VFS helper factored out for overlayfs, try_take_dentry_name_snapshot. He said the change fixed a real overlayfs bug yet smelled wrong: it failed incorrectly on rename races, and a separate "try" helper should not exist. The right model, in his view, is a single take_dentry_name_snapshot that always retries on dentry sequence changes and returns failure only when a name reference truly cannot be held despite a stable sequence.

Torvalds rewrote the helper himself through several iterations, fixing a leak path on external names, splitting release logic, and finally structuring it with RCU guards around an inner try routine. He committed the cleaned-up version after looking at the code enough, he wrote, that it lost all meaning.