[PATCH v2] ovl: reject lowerdir ending with unescaped backslash

[Guanglei Zhu]

In ovl_parse_param_split_lowerdirs() a backslash consumes the
character that follows it.  When the backslash is the last character
of the lowerdir value, it consumes the NUL terminator: the loop exits
normally and the backslash is kept in the output, so the lowerdir is
passed downstream with a trailing backslash and the mount fails later
with a confusing ENOENT from path lookup.

A trailing unescaped backslash escapes nothing, so reject it with
EINVAL.

Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
---
v2: fix the commit message.  v1 wrongly claimed that the loop
scans heap memory past the allocation; there is no out-of-bounds
access, the backslash merely consumes the NUL terminator.  Thanks
to Amir Goldstein and Sashiko for catching this.

Verified with an ASAN build of a user-space replica of the loop:
no out-of-bounds access, the output retains the trailing backslash.
With this patch fsconfig(lowerdir="...\") returns -EINVAL instead
of -ENOENT.

 fs/overlayfs/params.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
index c93fcaa45..5a15e5478 100644
--- a/fs/overlayfs/params.c
+++ b/fs/overlayfs/params.c
@@ -216,6 +216,9 @@ static ssize_t ovl_parse_param_split_lowerdirs(char *str)
 		if (*s == '\\') {
 			/* keep esc chars in split lowerdir */
 			*d++ = *s++;
+			/* A trailing backslash escapes nothing. */
+			if (!*s)
+				return -EINVAL;
 		} else if (*s == ':') {
 			bool next_colon = (*(s + 1) == ':');
 
-- 
2.43.0