containers / containers/fuse-overlayfs

[BUG] fuse-overlayfs can be tricked to omit directories with same inode

Open
#359 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
691
Forks
109
Avg merge
5d 7h
Merged PRs (30d)
2

Description

### Reproduction

```bash
mkdir lower upper work merged
mkdir -p lower/a/b lower/b
mount -B lower/a/b lower/b
fuse-overlayfs -o lowerdir=lower,upperdir=upper,workdir=work merged
ls lower
>> a b
ls merged
>> a
```

### Expected result

`merged` should contain both directories.

### The problem

When a new node has the same inode, this code checks if it's a directory, frees it if so, and returns the existing node: https://github.com/containers/fuse-overlayfs/blob/84240e9825033cfeae23237104cb51aca60912f9/main.c#L1194-L1206

This is clearly way too dangerous. However, the problem goes away if the `node_dirp (it)` condition is removed.

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the command sequence in the issue, then inspect main.c around lines 1194-1206, focusing on the same-inode directory handling. Verify that the merged directory retains both a and b, and ensure the corrected behavior is covered by an appropriate regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.