Re: [PATCH] ovl: reject lowerdir ending with unescaped backslash

[Amir Goldstein]

On Mon, Oct 12, 2026 at 8:08 AM Guanglei Zhu <zhugl3@xxxxxxxxxxxx> wrote:
>
> In ovl_parse_param_split_lowerdirs() the escape handling consumes
> the backslash and the character after it.  When the backslash is the
> last character of the lowerdir value, the loop increment moves the
> cursor past the NUL terminator, so the loop scans heap memory beyond
> the kstrdup'd string until it happens to hit a zero byte; a colon
> found there is written over as well.
>
> A trailing unescaped backslash escapes nothing, so reject it with
> EINVAL.
>
> Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
> ---
> Found by code inspection.  Behavior check in a QEMU guest:
> fsconfig(lowerdir="...\") on an unpatched kernel returns -ENOENT
> after the loop scanned past the allocation; with this patch it
> returns -EINVAL.
>
>  fs/overlayfs/params.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
> index c93fcaa45..5a15e5478 100644
> --- a/fs/overlayfs/params.c
> +++ b/fs/overlayfs/params.c
> @@ -216,6 +216,9 @@ static ssize_t ovl_parse_param_split_lowerdirs(char *str)
>                 if (*s == '\\') {
>                         /* keep esc chars in split lowerdir */
>                         *d++ = *s++;
> +                       /* A trailing backslash escapes nothing. */
> +                       if (!*s)
> +                               return -EINVAL;
>                 } else if (*s == ':') {
>                         bool next_colon = (*(s + 1) == ':');
>
> --
> 2.43.0
>

Hi Guanglei Zhu,

The fix looks correct, but the commit message is inaccurately making
wrong claims about heap memory and scanning past the allocation,
which makes this sound more severe than it actually is.

See Sashiko review comment:
https://sashiko.dev/#/patchset/20261012060847.836027-1-zhugl3%40xiaopeng.com

Thanks,
Amir.