This sounds Ubuntu specific: "Ubuntu carries a patch that allows overlayfs mounting inside of an unprivileged user namespace, so we were carrying the fix mentioned above as a delta against the upstream Linux kernel since the issue didn't affect upstream overlayfs. (It is worth noting that we did share the details of CVE-2015-1328 and the fix privately with upstream overlayfs)" - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1793458/comments/4

The two patches are :-
- eea2fb4851e9 ("ovl: proper cleanup of workdir")
     present in v4.4, v4.14, chromeos-4.19
- c0ca3d70e8d3 ("ovl: modify ovl_permission() to do checks on two inodes")
     present in v4.14, chromeos-4.19. Seems to cause a conflict when applying to v4.4.

Marking as WontFix.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/108f367d095921119cefe303721a49f96a60d574

commit 108f367d095921119cefe303721a49f96a60d574
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date: Tue Dec 11 00:00:32 2018

UPSTREAM: Make file credentials available to the seqfile interfaces

commit 34dbbcdbf63360661ff7bda6c5f52f99ac515f92 upstream.

A lot of seqfile users seem to be using things like %pK that uses the
credentials of the current process, but that is actually completely
wrong for filesystem interfaces.

The unix semantics for permission checking files is to check permissions
at _open_ time, not at read or write time, and that is not just a small
detail: passing off stdin/stdout/stderr to a suid application and making
the actual IO happen in privileged context is a classic exploit
technique.

So if we want to be able to look at permissions at read time, we need to
use the file open credentials, not the current ones.  Normal file
accesses can just use "f_cred" (or any of the helper functions that do
that, like file_ns_capable()), but the seqfile interfaces do not have
any such options.

It turns out that seq_file _does_ save away the user_ns information of
the file, though.  Since user_ns is just part of the full credential
information, replace that special case with saving off the cred pointer
instead, and suddenly seq_file has all the permission information it
needs.

BUG= chromium:912891 
TEST=None

Change-Id: I9b50641b597a008e13415fe45acd307378188df6
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jann Horn <jannh@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 685adc73d6118863b385cd7084ecde7cd805b0a6
	from linux-3.18.y)
Signed-off-by: Zubin Mithra <zsm@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1368282

[modify] https://crrev.com/108f367d095921119cefe303721a49f96a60d574/fs/seq_file.c
[modify] https://crrev.com/108f367d095921119cefe303721a49f96a60d574/include/linux/seq_file.h

#6: Correction, the patch is a fix for crbug.com/912887, not this bug.