From 99ae7dc439249b47a72eda07f78e02290fa1aebc Mon Sep 17 00:00:00 2001 From: Guanglei Zhu Date: Mon, 12 Oct 2026 17:55:38 +0800 Subject: [PATCH] ovl: reject lowerdir ending with unescaped backslash In ovl_parse_param_split_lowerdirs() a backslash consumes the character that follows it. When the backslash is the last character of the lowerdir value, it consumes the NUL terminator: the loop exits normally and the backslash is kept in the output, so the lowerdir is passed downstream with a trailing backslash and the mount fails later with a confusing ENOENT from path lookup. A trailing unescaped backslash escapes nothing, so reject it with EINVAL. Signed-off-by: Guanglei Zhu Link: https://patch.msgid.link/20261012095538.938789-1-zhugl3@xiaopeng.com Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner (Amutable) --- fs/overlayfs/params.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c index c93fcaa45d4a..5a15e5478a6b 100644 --- a/fs/overlayfs/params.c +++ b/fs/overlayfs/params.c @@ -216,6 +216,9 @@ static ssize_t ovl_parse_param_split_lowerdirs(char *str) if (*s == '\\') { /* keep esc chars in split lowerdir */ *d++ = *s++; + /* A trailing backslash escapes nothing. */ + if (!*s) + return -EINVAL; } else if (*s == ':') { bool next_colon = (*(s + 1) == ':');