[PATCH] ovl: reject lowerdir ending with unescaped backslash

[PATCH] ovl: reject lowerdir ending with unescaped backslash

[Guanglei Zhu]

In ovl_parse_param_split_lowerdirs() the escape handling consumes
the backslash and the character after it.  When the backslash is the
last character of the lowerdir value, the loop increment moves the
cursor past the NUL terminator, so the loop scans heap memory beyond
the kstrdup'd string until it happens to hit a zero byte; a colon
found there is written over as well.

A trailing unescaped backslash escapes nothing, so reject it with
EINVAL.

Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>
---
Found by code inspection.  Behavior check in a QEMU guest:
fsconfig(lowerdir="...\") on an unpatched kernel returns -ENOENT
after the loop scanned past the allocation; with this patch it
returns -EINVAL.

 fs/overlayfs/params.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
index c93fcaa45..5a15e5478 100644
--- a/fs/overlayfs/params.c
+++ b/fs/overlayfs/params.c
@@ -216,6 +216,9 @@ static ssize_t ovl_parse_param_split_lowerdirs(char *str)
 		if (*s == '\\') {
 			/* keep esc chars in split lowerdir */
 			*d++ = *s++;
+			/* A trailing backslash escapes nothing. */
+			if (!*s)
+				return -EINVAL;
 		} else if (*s == ':') {
 			bool next_colon = (*(s + 1) == ':');
 
-- 
2.43.0

Re: [PATCH] ovl: reject lowerdir ending with unescaped backslash

[Amir Goldstein]

On Mon, Oct 12, 2026 at 8:08 AM Guanglei Zhu <zhugl3@xiaopeng.com> wrote:
>
> In ovl_parse_param_split_lowerdirs() the escape handling consumes
> the backslash and the character after it.  When the backslash is the
> last character of the lowerdir value, the loop increment moves the
> cursor past the NUL terminator, so the loop scans heap memory beyond
> the kstrdup'd string until it happens to hit a zero byte; a colon
> found there is written over as well.
>
> A trailing unescaped backslash escapes nothing, so reject it with
> EINVAL.
>
> Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>
> ---
> Found by code inspection.  Behavior check in a QEMU guest:
> fsconfig(lowerdir="...\") on an unpatched kernel returns -ENOENT
> after the loop scanned past the allocation; with this patch it
> returns -EINVAL.
>
>  fs/overlayfs/params.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
> index c93fcaa45..5a15e5478 100644
> --- a/fs/overlayfs/params.c
> +++ b/fs/overlayfs/params.c
> @@ -216,6 +216,9 @@ static ssize_t ovl_parse_param_split_lowerdirs(char *str)
>                 if (*s == '\\') {
>                         /* keep esc chars in split lowerdir */
>                         *d++ = *s++;
> +                       /* A trailing backslash escapes nothing. */
> +                       if (!*s)
> +                               return -EINVAL;
>                 } else if (*s == ':') {
>                         bool next_colon = (*(s + 1) == ':');
>
> --
> 2.43.0
>

Hi Guanglei Zhu,

The fix looks correct, but the commit message is inaccurately making
wrong claims about heap memory and scanning past the allocation,
which makes this sound more severe than it actually is.

See Sashiko review comment:
https://sashiko.dev/#/patchset/20261012060847.836027-1-zhugl3%40xiaopeng.com

Thanks,
Amir.

[PATCH v2] ovl: reject lowerdir ending with unescaped backslash

[Guanglei Zhu]

In ovl_parse_param_split_lowerdirs() a backslash consumes the
character that follows it.  When the backslash is the last character
of the lowerdir value, it consumes the NUL terminator: the loop exits
normally and the backslash is kept in the output, so the lowerdir is
passed downstream with a trailing backslash and the mount fails later
with a confusing ENOENT from path lookup.

A trailing unescaped backslash escapes nothing, so reject it with
EINVAL.

Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>
---
v2: fix the commit message.  v1 wrongly claimed that the loop
scans heap memory past the allocation; there is no out-of-bounds
access, the backslash merely consumes the NUL terminator.  Thanks
to Amir Goldstein and Sashiko for catching this.

Verified with an ASAN build of a user-space replica of the loop:
no out-of-bounds access, the output retains the trailing backslash.
With this patch fsconfig(lowerdir="...\") returns -EINVAL instead
of -ENOENT.

 fs/overlayfs/params.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
index c93fcaa45..5a15e5478 100644
--- a/fs/overlayfs/params.c
+++ b/fs/overlayfs/params.c
@@ -216,6 +216,9 @@ static ssize_t ovl_parse_param_split_lowerdirs(char *str)
 		if (*s == '\\') {
 			/* keep esc chars in split lowerdir */
 			*d++ = *s++;
+			/* A trailing backslash escapes nothing. */
+			if (!*s)
+				return -EINVAL;
 		} else if (*s == ':') {
 			bool next_colon = (*(s + 1) == ':');
 
-- 
2.43.0

Re: [PATCH v2] ovl: reject lowerdir ending with unescaped backslash

[Amir Goldstein]

On Mon, Oct 12, 2026 at 11:55 AM Guanglei Zhu <zhugl3@xiaopeng.com> wrote:
>
> In ovl_parse_param_split_lowerdirs() a backslash consumes the
> character that follows it.  When the backslash is the last character
> of the lowerdir value, it consumes the NUL terminator: the loop exits
> normally and the backslash is kept in the output, so the lowerdir is
> passed downstream with a trailing backslash and the mount fails later
> with a confusing ENOENT from path lookup.
>
> A trailing unescaped backslash escapes nothing, so reject it with
> EINVAL.
>
> Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>
> ---
> v2: fix the commit message.  v1 wrongly claimed that the loop
> scans heap memory past the allocation; there is no out-of-bounds
> access, the backslash merely consumes the NUL terminator.  Thanks
> to Amir Goldstein and Sashiko for catching this.
>
> Verified with an ASAN build of a user-space replica of the loop:
> no out-of-bounds access, the output retains the trailing backslash.
> With this patch fsconfig(lowerdir="...\") returns -EINVAL instead
> of -ENOENT.
>
>  fs/overlayfs/params.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
> index c93fcaa45..5a15e5478 100644
> --- a/fs/overlayfs/params.c
> +++ b/fs/overlayfs/params.c
> @@ -216,6 +216,9 @@ static ssize_t ovl_parse_param_split_lowerdirs(char *str)
>                 if (*s == '\\') {
>                         /* keep esc chars in split lowerdir */
>                         *d++ = *s++;
> +                       /* A trailing backslash escapes nothing. */
> +                       if (!*s)
> +                               return -EINVAL;
>                 } else if (*s == ':') {
>                         bool next_colon = (*(s + 1) == ':');
>
> --
> 2.43.0
>

Reviewed-by: Amir Goldstein <amir73il@gmail.com>

Christian,

Could you pick this up via vfs.fixes?

Thanks,
Amir.

Re: [PATCH v2] ovl: reject lowerdir ending with unescaped backslash

[Christian Brauner]

> Christian,
> 
> Could you pick this up via vfs.fixes?

In vfs.fixes now. Thanks!

Re: [PATCH v2] ovl: reject lowerdir ending with unescaped backslash

[Christian Brauner]

On Mon, 12 Oct 2026 17:55:38 +0800, Guanglei Zhu wrote:
> In ovl_parse_param_split_lowerdirs() a backslash consumes the
> character that follows it.  When the backslash is the last character
> of the lowerdir value, it consumes the NUL terminator: the loop exits
> normally and the backslash is kept in the output, so the lowerdir is
> passed downstream with a trailing backslash and the mount fails later
> with a confusing ENOENT from path lookup.
> 
> [...]

Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes

[1/1] ovl: reject lowerdir ending with unescaped backslash
      https://git.kernel.org/vfs/vfs/c/81f4be14beee