Re: [PATCH v2] ovl: reject lowerdir ending with unescaped backslash

[Amir Goldstein]

On Mon, Oct 12, 2026 at 11:55 AM Guanglei Zhu <zhugl3@xxxxxxxxxxxx> wrote:
>
> In ovl_parse_param_split_lowerdirs() a backslash consumes the
> character that follows it.  When the backslash is the last character
> of the lowerdir value, it consumes the NUL terminator: the loop exits
> normally and the backslash is kept in the output, so the lowerdir is
> passed downstream with a trailing backslash and the mount fails later
> with a confusing ENOENT from path lookup.
>
> A trailing unescaped backslash escapes nothing, so reject it with
> EINVAL.
>
> Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
> ---
> v2: fix the commit message.  v1 wrongly claimed that the loop
> scans heap memory past the allocation; there is no out-of-bounds
> access, the backslash merely consumes the NUL terminator.  Thanks
> to Amir Goldstein and Sashiko for catching this.
>
> Verified with an ASAN build of a user-space replica of the loop:
> no out-of-bounds access, the output retains the trailing backslash.
> With this patch fsconfig(lowerdir="...\") returns -EINVAL instead
> of -ENOENT.
>
>  fs/overlayfs/params.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
> index c93fcaa45..5a15e5478 100644
> --- a/fs/overlayfs/params.c
> +++ b/fs/overlayfs/params.c
> @@ -216,6 +216,9 @@ static ssize_t ovl_parse_param_split_lowerdirs(char *str)
>                 if (*s == '\\') {
>                         /* keep esc chars in split lowerdir */
>                         *d++ = *s++;
> +                       /* A trailing backslash escapes nothing. */
> +                       if (!*s)
> +                               return -EINVAL;
>                 } else if (*s == ':') {
>                         bool next_colon = (*(s + 1) == ':');
>
> --
> 2.43.0
>

Reviewed-by: Amir Goldstein <amir73il@xxxxxxxxx>

Christian,

Could you pick this up via vfs.fixes?

Thanks,
Amir.