From nobody Tue Sep 29 13:20:32 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7682A3932C2 for ; Fri, 7 Aug 2026 07:05:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786086353; cv=none; b=Lj1m1w24BhiIMXdjURxOBL6QSItsqW0+2In93gpxv1wZwyQ5nJqAXEBPGHuCpvwftgCCjToDa5BxwKQqkNgCTnO7In6JSCl/XelH7NeqAmRiN2PiNVm/vBhkv1FROmvkHQgO1o6xjTn/xtFFChRr2DvLvh+ylqszg7WWb/rZJss= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786086353; c=relaxed/simple; bh=0BSwFZg9jiOOf7YFllMbZ9tdQprZENRwTtd4sYc6ERE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=FV+qo9gCsfmdPeOt/NhFAJ1jQufkmk79yk1cvFLsVo3FvcJto09behI5H0BQzVfSa5OcCZ7aTGuRGat/qWE/NvSCE9Rzj73BGA7Ff4Zbf0KDpe0nRKVZNo096LzOSEeFnrE4Xau5RNlpcC6DXtgbWEZULWl+a+3nv5nrlqEzp7Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=bWfqsmLt; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=XsRAds/I; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="bWfqsmLt"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="XsRAds/I" Received: from pps.filterd (m0279865.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6770GfdI4063303 for ; Fri, 7 Aug 2026 07:05:48 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=guyea8cIujPgoSwckRlogS 1AkJcoAzrtOivJuLB5mfs=; b=bWfqsmLtQqi+E59YlwG6r9YmtB0e1emD61jJad vQg2DjGs/mlc2moe9T7G1i28cbTvX6yEf1gd964mUzQi2qOlORGN4OFHk4nn+T5V YfMV+nhGldm+KoMLd1IfC28eJ7eCj1nCb0Oq19DvWJR4HvIq/pT5/OU040bTdz17 /Oh8KwogyjekH3wnBk+vA7w0w4PuKJecYPcwJqiQi5icLgFqUeWuU8CZHE7D7vvt 7sGcW9bp5PVAw1i+VW5zlez+daP9TCLlsht0kil5ft/110Sm4g8EvTOARIu0x5JK t83AJ5IiGrXPy9Vsx147FGo1FxUBVAtgdsh3m1LNb6w5ekIQ== Received: from mail-pj1-f69.google.com (mail-pj1-f69.google.com [209.85.216.69]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fvy6hamnn-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 07 Aug 2026 07:05:48 +0000 (GMT) Received: by mail-pj1-f69.google.com with SMTP id 98e67ed59e1d1-388cfc4848dso3930664a91.3 for ; Fri, 07 Aug 2026 00:05:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1786086348; x=1786691148; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=guyea8cIujPgoSwckRlogS1AkJcoAzrtOivJuLB5mfs=; b=XsRAds/Ical4c/SJLriy6FxOVOVQdPXHV/M9Oit67APhIbpujaESf8iIa+nM55dmKN +lfSDUMMLtaTmsyhe2t1flndzUahfqcnbBIuVPF217M0zQQDmVp4jSKjYeiSOiZZLxrY J9WCgAF2fsXyCPs1DPW4DdCfwvMIDbOIDTTv4u8t0gckpdZnnVshA2+W2DToeZj0SflX mLRtSRDg57aGhEdlJqy70F0H8d2IKh/3GZB16CzcQY4/0CNFyEsTixEfFgx5i3Tmv4jP QuocEA0N93X6uZEnF8ZsKxZB0u2dDG6wbtBngNpV8kX/NW968X8dShDYRJYuApYuSDVY LDCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786086348; x=1786691148; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=guyea8cIujPgoSwckRlogS1AkJcoAzrtOivJuLB5mfs=; b=mNsFa33MdoXZo6LNT3xtFJyK6jCXOCIzEq0Y5UtSOMoKRqQjGle4xi+xpnpA0U2v07 Ue+Sh0ktF+uah1kiONAShxVTEf+w6lPcc7lSq8HHA+dY7OexLMMVLm600kXyiWi1t/5k E2e2MmMboetZLbs2Ds1vlj8UY5TNLKQup74hAetd14qkz72xLo1kK6W6BnkGeZr5/lwj MgrQRLOsL8RZGVgH6Hhc0ZapV6HAl5436LF5zjBoxk83YpZB9m2aD7exkXPxT8PELK3/ ayMbnsuUV44o85/Ts97+1J4Kek7ABa7514wIp4JZqR8XZ6qT7LjbrvbrCoq7SoLwc7V4 YPYw== X-Forwarded-Encrypted: i=1; AHgh+RqCjLB0CTIwf/zfhuFlFicL8MJRVC8vQnsChlhxzHWO3VnEWlCzRRUs/OvqYtxzbpq5VeLYNMjkvRmFZKA=@vger.kernel.org X-Gm-Message-State: AOJu0Yw+55x1lbryEDE6DU3WwTIStd32I0GiR/kVt6oOld0M4dzIEb2n ABH9VzlTG0dutaRQGCtVwyQA08mKf9MEPJZYpkC4ks5nI0O77bsByH1tSAB6lClaaJWFXZZfv39 dyZHM+e0pEw5/OGUhJTCMM0AXE6ePPT8f1Dk17/kjMQLKdKXNk0s62pqvMeUNICW9COo= X-Gm-Gg: AR+sD10YrLxAHfXoFsDpvhZkrmRorplvAiYJF12GFj0sz4jlQn4YzYoTTAWVQqYXrxt Xjar5MtwaDCYBC7MuwUwnv1DiQozvFL3mYOXj4A4CpwwhhSFdlj9pNFoBOpOhZEMRy1O3HsonYU ME91MCSAW8TKg85A62jTZOZOYBxYvdDqcePfNxJIX0UzRaATzDXVRlBcUfBKk8hWaxI/8p6iGXo hkKlqUfyNSObDlPpz1d/H1lvPUm0tjX9DVpXPwSe5RWqRpG7tw2lJzIMxaMXgknISnBXe6atuP4 TNV5MNqPh+dswDh+TXeY7Vd3EIaTdcyWVMBexdmP0b2jcNr7THBluga3Wv97YXOuC51wqOHMDVq DTJmAiVfjKak7Tq4sgObSTS/DTjIY7wLImPivi1igh7pOmXCzT71MHwcrMbkBsb3qxw6LDCZ61u Qz/uHLzkZUlQk7NK9hD1ncVYS9OgztjA== X-Received: by 2002:a17:90b:28cf:b0:381:11eb:d78e with SMTP id 98e67ed59e1d1-3903c5d321dmr20548530a91.14.1786086347893; Fri, 07 Aug 2026 00:05:47 -0700 (PDT) X-Received: by 2002:a17:90b:28cf:b0:381:11eb:d78e with SMTP id 98e67ed59e1d1-3903c5d321dmr20548476a91.14.1786086347450; Fri, 07 Aug 2026 00:05:47 -0700 (PDT) Received: from hu-varada-blr.qualcomm.com (blr-bdr-fw-01_GlobalNAT_AllZones-Outside.qualcomm.com. [103.229.18.19]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315bebdf796sm3815914eec.22.2026.08.07.00.05.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Aug 2026 00:05:47 -0700 (PDT) From: Varadarajan Narayanan Date: Fri, 07 Aug 2026 12:35:25 +0530 Subject: [PATCH] ovl: fix NULL pointer dereference in ovl_i_path_real() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260807-kasan-v1-1-50da6e58cc20@oss.qualcomm.com> X-B4-Tracking: v=1; b=H4sIALSDdWoC/y3MQQqDMBCF4auEWXcgCjHWq4iLNI46FKPNpEUQ7 96gLv/H49tBKDIJNGqHSD8WXkKO4qHATy6MhNznhlKXla51hW8nLqB56sJ6O9i+NpC/a6SBt9N pu6sjfb6ZS9cILyeEfplnTo0KtCW8SQPdcfwB92UN3IgAAAA= X-Change-ID: 20260806-kasan-59017c7f7d85 To: Miklos Szeredi , Amir Goldstein Cc: Miklos Szeredi , linux-unionfs@vger.kernel.org, linux-kernel@vger.kernel.org, Varadarajan Narayanan X-Mailer: b4 0.14.3 X-Authority-Analysis: v=2.4 cv=G60s1dk5 c=1 sm=1 tr=0 ts=6a7583cc cx=c_pps a=vVfyC5vLCtgYJKYeQD43oA==:117 a=Ou0eQOY4+eZoSc0qltEV5Q==:17 a=IkcTkHD0fZMA:10 a=Sv0fKeRqtYgA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=Um2Pa8k9VHT-vaBCBUpS:22 a=EUspDBNiAAAA:8 a=ZzjbTN-_bFd17bKXsZsA:9 a=QEXdDO2ut3YA:10 a=rl5im9kqc5Lf4LNbBjHf:22 X-Proofpoint-GUID: ltAehC755t-mUwxPiykTd2I13znlqR_E X-Proofpoint-ORIG-GUID: ltAehC755t-mUwxPiykTd2I13znlqR_E X-Proofpoint-Spam-Info: AW1haW4tMjYwODA3MDA1MSBTYWx0ZWRfX84f6SoQvHH3m Qn7QySIrOrNJzSQe8Yzgpw2xBKGJjFqLcA29++l/f9ZxbbptO+dOMGHIRwJ+RXVpW40bLBHFhkm aUMQO4J6TmTRcXvOs12ewEuKaAlp+jc= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODA3MDA1MSBTYWx0ZWRfXxesN09xnOnHf Vo8Hhh1gMcjyovVwbYfIisqLs1yUV0XzsFO+xs6x44E0JsvEXEHBbIeX+JWue1n5jq7k1mQCT0O PLoWbOVPWOYBsBGbiIM8dEcpZ/wqm6UykAuMJEGjnRHDv4YQSP7t8KSjMrWi8kOLVMemEUK9r+I so2c1px/p8uD9PTmrrCO0Q1O1ZEI4c1MO3cPMT5dz7VJCPL6s4WjuGBZLRT5ErRA63XsFeO7/O+ RBbDTy76yrcALkBO2JWyfimxAB7+dOpabHmlBwhI+GUGudl0ZMQOZ9xQI3LjyNhHwstTIb88Zq1 RdGCoOkautgq1HMJ42y61w7SnVRT6Dei1e8TaFUy7z0tuU+uFVsJWbCTIZ6s9jgW61AW77O9RMz 9+N0FSFXwEmqcRW1P4r6+JDOzVp2VLaVodNmRF7gMBTGltmbBRqkPykSPPLbLDfM4a4RBoxuaOb MvQfgQp6MUr06HMl17A== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-07_01,2026-08-06_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 adultscore=0 spamscore=0 clxscore=1015 phishscore=0 suspectscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608070051 KASAN reported a NULL pointer dereference in ovl_permission() when it called mnt_idmap(realpath.mnt): BUG: KASAN: null-ptr-deref in ovl_permission+0x150/0x190 Read of size 8 at addr 0000000000000018 ovl_i_path_real() can return a path with a valid dentry but a NULL mnt. This happens when the inode has an upper dentry, but ovl_upper_mnt() returns NULL, for example on an overlay without an upper layer. The caller then dereferences realpath.mnt and crashes. Also avoid dereferencing lowerpath when it is NULL. Fix this by checking lowerpath before using it, and by clearing path->dentry when no upper mount is available. This makes ovl_i_path_real() return NULL and lets callers use their existing error handling path. Call trace: ... __kasan_check_read+0x1c/0x24 ovl_permission+0x150/0x190 inode_permission+0x7c/0x204 may_open+0x84/0x14c path_openat+0xdf0/0xf60 do_filp_open+0xbc/0x148 do_sys_openat2+0x268/0x2bc do_sys_open+0xd4/0x108 Signed-off-by: Varadarajan Narayanan --- fs/overlayfs/util.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c index b41f4788e4f0..ec423e16cbbd 100644 --- a/fs/overlayfs/util.c +++ b/fs/overlayfs/util.c @@ -380,10 +380,16 @@ struct inode *ovl_i_path_real(struct inode *inode, st= ruct path *path) =20 path->dentry =3D ovl_i_dentry_upper(inode); if (!path->dentry) { - path->dentry =3D lowerpath->dentry; - path->mnt =3D lowerpath->layer->mnt; + if (lowerpath) { + path->dentry =3D lowerpath->dentry; + path->mnt =3D lowerpath->layer->mnt; + } else { + path->mnt =3D NULL; + } } else { path->mnt =3D ovl_upper_mnt(OVL_FS(inode->i_sb)); + if (unlikely(!path->mnt)) + path->dentry =3D NULL; } =20 return path->dentry ? d_inode_rcu(path->dentry) : NULL; --- base-commit: b19e11d4f1fc76a3bfcd153e8eeb4e67f6b9f645 change-id: 20260806-kasan-59017c7f7d85 Best regards, --=20 Varadarajan Narayanan