[PATCH] ovl: fix NULL pointer dereference in ovl_i_path_real()

[Varadarajan Narayanan]

KASAN reported a NULL pointer dereference in ovl_permission() when it
called mnt_idmap(realpath.mnt):

	BUG: KASAN: null-ptr-deref in ovl_permission+0x150/0x190
	Read of size 8 at addr 0000000000000018

ovl_i_path_real() can return a path with a valid dentry but a NULL mnt.
This happens when the inode has an upper dentry, but ovl_upper_mnt()
returns NULL, for example on an overlay without an upper layer. The caller
then dereferences realpath.mnt and crashes.

Also avoid dereferencing lowerpath when it is NULL.

Fix this by checking lowerpath before using it, and by clearing
path->dentry when no upper mount is available. This makes ovl_i_path_real()
return NULL and lets callers use their existing error handling path.

Call trace:
	 ...
	 __kasan_check_read+0x1c/0x24
	 ovl_permission+0x150/0x190
	 inode_permission+0x7c/0x204
	 may_open+0x84/0x14c
	 path_openat+0xdf0/0xf60
	 do_filp_open+0xbc/0x148
	 do_sys_openat2+0x268/0x2bc
	 do_sys_open+0xd4/0x108

Signed-off-by: Varadarajan Narayanan <varadarajan.narayanan@xxxxxxxxxxxxxxxx>
---
 fs/overlayfs/util.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index b41f4788e4f0..ec423e16cbbd 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -380,10 +380,16 @@ struct inode *ovl_i_path_real(struct inode *inode, struct path *path)
 
 	path->dentry = ovl_i_dentry_upper(inode);
 	if (!path->dentry) {
-		path->dentry = lowerpath->dentry;
-		path->mnt = lowerpath->layer->mnt;
+		if (lowerpath) {
+			path->dentry = lowerpath->dentry;
+			path->mnt = lowerpath->layer->mnt;
+		} else {
+			path->mnt = NULL;
+		}
 	} else {
 		path->mnt = ovl_upper_mnt(OVL_FS(inode->i_sb));
+		if (unlikely(!path->mnt))
+			path->dentry = NULL;
 	}
 
 	return path->dentry ? d_inode_rcu(path->dentry) : NULL;

---
base-commit: b19e11d4f1fc76a3bfcd153e8eeb4e67f6b9f645
change-id: 20260806-kasan-59017c7f7d85

Best regards,
-- 
Varadarajan Narayanan <varadarajan.narayanan@xxxxxxxxxxxxxxxx>