ovl: reject lowerdir ending with unescaped backslash

In ovl_parse_param_split_lowerdirs() a backslash consumes the
character that follows it.  When the backslash is the last character
of the lowerdir value, it consumes the NUL terminator: the loop exits
normally and the backslash is kept in the output, so the lowerdir is
passed downstream with a trailing backslash and the mount fails later
with a confusing ENOENT from path lookup.

A trailing unescaped backslash escapes nothing, so reject it with
EINVAL.

Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Link: https://patch.msgid.link/20261012095538.938789-1-zhugl3@xiaopeng.com
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

fs/overlayfs/params.c

@@ -216,6 +216,9 @@ static ssize_t ovl_parse_param_split_lowerdirs(char *str)
 		if (*s == '\\') {
 			/* keep esc chars in split lowerdir */
 			*d++ = *s++;
+			/* A trailing backslash escapes nothing. */
+			if (!*s)
+				return -EINVAL;
 		} else if (*s == ':') {
 			bool next_colon = (*(s + 1) == ':');