Overlayfs will stop hiding missing file data from the kernel
Uprobes, IMA, IPE and a BPF helper have been treating a failed data lookup as if the overlay inode were the real file.
Christian Brauner is changing a long-standing overlayfs shortcut so that a failed lookup of a file's real data is an error, not a warning the rest of the kernel ignores.
Overlayfs can keep a file's metadata in one layer and its contents in a data-only layer, and it resolves that data only when something first needs it. The lookup can fail because the data is missing, a verity digest does not match, or the wait for the inode lock is interrupted. The helper that is supposed to return the inode hosting the data had no way to say so. Overlayfs warned and handed back its own dentry. Every caller then worked on an inode that does not hold the file's contents.
That showed up first in uprobes. A probe on a metacopy file whose redirect points at nothing was created successfully and failed later with an -EIO that had nothing to do with the missing data. Each new probe warned again, which is a panic on systems that panic on warnings. Chris Down and an automated reporter hit that path. The same wrong inode reached integrity and policy code: IMA skipped change detection on the backing file and reused a cached verdict, and IPE judged the file against an inode with none of the dm-verity or fs-verity properties of the real data. A metadata-only copy-up of a file that is already open can force the digest check again, so this is not limited to files nobody has opened.
Amir Goldstein's suggested fix is to make the lookup able to fail and to make every caller handle it. Uprobes will fail when they are created, with the real error rather than a later -EIO. IMA will treat an unresolvable data inode like a failed hash. IPE will deny the operation unless it is in permissive mode. The BPF helper that returns the data inode will return NULL, which programs already have to check. The old helper that could not fail is going away, so a new caller cannot silently drop the error. The warning itself is marked for stable kernels back to 6.5. The rest of the change stands on its own, though Brauner ran into it while working on freeze protection for backing files and on fuse passthrough of O_PATH files.