kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/fs/overlayfs
History
André Almeida ec5f0b4412 ovl: Fix nested backing file paths 
commit 924577e4f6 upstream.

When the lowerdir of an overlayfs is a merged directory of another
overlayfs, ovl_open_realfile() will fail to open the real file and point
to a lower dentry copy, without the proper parent path. After this,
d_path() will then display the path incorrectly as if the file is placed
in the root directory.

This bug can be triggered with the following setup:

 mkdir -p ovl-A/lower ovl-A/upper ovl-A/merge ovl-A/work
 mkdir -p ovl-B/upper ovl-B/merge ovl-B/work

 cp /bin/cat ovl-A/lower/

 mount -t overlay overlay -o \
 lowerdir=ovl-A/lower,upperdir=ovl-A/upper,workdir=ovl-A/work \
 ovl-A/merge

 mount -t overlay overlay -o \
 lowerdir=ovl-A/merge,upperdir=ovl-B/upper,workdir=ovl-B/work \
 ovl-B/merge

 ovl-A/merge/cat /proc/self/maps | grep --color cat
 ovl-B/merge/cat /proc/self/maps | grep --color cat

The first cat will correctly show `/ovl-A/merge/cat`, while the second
one shows just `/cat`.

To fix that, uses file_user_path() inside of backing_file_open() to get
the correct file path for the dentry.

Co-developed-by: John Schoenick <johns@valvesoftware.com>
Signed-off-by: John Schoenick <johns@valvesoftware.com>
Signed-off-by: André Almeida <andrealmeid@igalia.com>
Fixes: def3ae83da ("fs: store real path instead of fake path in backing file f_path")
Cc: <stable@vger.kernel.org> # v6.7
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-06-27 11:11:24 +01:00
..
copy_up.c ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up 2025-03-07 18:25:26 +01:00
dir.c ovl: fix copy-up in tmpfile 2024-05-28 10:06:55 +02:00
export.c ovl: support encoding fid from inode with no alias 2025-01-17 13:40:36 +01:00
file.c ovl: Fix nested backing file paths 2025-06-27 11:11:24 +01:00
inode.c ovl: properly handle large files in ovl_security_fileattr 2024-12-09 10:41:08 +01:00
Kconfig fs: prepare for stackable filesystems backing file helpers 2023-12-23 16:35:08 +02:00
Makefile ovl: Move xattr support to new xattrs.c file 2023-10-31 00:12:59 +02:00
namei.c ovl: pass realinode to ovl_encode_real_fh() instead of realdentry 2025-01-17 13:40:36 +01:00
overlayfs.h ovl: remove unused forward declaration 2025-04-25 10:47:39 +02:00
ovl_entry.h ovl: mark xwhiteouts directory with overlay.opaque='x' 2024-01-23 12:39:48 +02:00
params.c ovl: fail if trusted xattrs are needed but caller lacks permission 2024-09-08 15:36:59 +02:00
params.h ovl: store and show the user provided lowerdir mount option 2023-10-31 00:13:02 +02:00
readdir.c ovl: mark xwhiteouts directory with overlay.opaque='x' 2024-01-23 12:39:48 +02:00
super.c ovl: don't allow datadir only 2025-04-25 10:47:53 +02:00
util.c ovl: Filter invalid inodes with missing lookup function 2024-12-09 10:41:01 +01:00
xattrs.c ovl: Support escaped overlay.* xattrs 2023-10-31 00:12:59 +02:00