[PATCH] ovl: reject lowerdir ending with unescaped backslash

[Guanglei Zhu]

In ovl_parse_param_split_lowerdirs() the escape handling consumes
the backslash and the character after it.  When the backslash is the
last character of the lowerdir value, the loop increment moves the
cursor past the NUL terminator, so the loop scans heap memory beyond
the kstrdup'd string until it happens to hit a zero byte; a colon
found there is written over as well.

A trailing unescaped backslash escapes nothing, so reject it with
EINVAL.

Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
---
Found by code inspection.  Behavior check in a QEMU guest:
fsconfig(lowerdir="...\") on an unpatched kernel returns -ENOENT
after the loop scanned past the allocation; with this patch it
returns -EINVAL.

 fs/overlayfs/params.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
index c93fcaa45..5a15e5478 100644
--- a/fs/overlayfs/params.c
+++ b/fs/overlayfs/params.c
@@ -216,6 +216,9 @@ static ssize_t ovl_parse_param_split_lowerdirs(char *str)
 		if (*s == '\\') {
 			/* keep esc chars in split lowerdir */
 			*d++ = *s++;
+			/* A trailing backslash escapes nothing. */
+			if (!*s)
+				return -EINVAL;
 		} else if (*s == ':') {
 			bool next_colon = (*(s + 1) == ':');
 
-- 
2.43.0