Commit 4aead50c authored Jul 10, 2025 by Ryusuke Konishi Committed by Andrew Morton Jul 19, 2025

nilfs2: reject invalid file types when reading inodes

To prevent inodes with invalid file types from tripping through the vfs
and causing malfunctions or assertion failures, add a missing sanity check
when reading an inode from a block device.  If the file type is not valid,
treat it as a filesystem error.

Link: https://lkml.kernel.org/r/20250710134952.29862-1-konishi.ryusuke@gmail.com


Fixes: 05fe58fd ("nilfs2: inode operations")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by:  <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d


Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

parent 7563fcbf

fs/nilfs2/inode.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -472,11 +472,18 @@ static int __nilfs_read_inode(struct super_block *sb,
		inode->i_op = &nilfs_symlink_inode_operations;
		inode_nohighmem(inode);
		inode->i_mapping->a_ops = &nilfs_aops;
		} else {
		} else if (S_ISCHR(inode->i_mode) \|\| S_ISBLK(inode->i_mode) \|\|
		S_ISFIFO(inode->i_mode) \|\| S_ISSOCK(inode->i_mode)) {
		inode->i_op = &nilfs_special_inode_operations;
		init_special_inode(
		inode, inode->i_mode,
		huge_decode_dev(le64_to_cpu(raw_inode->i_device_code)));
		} else {
		nilfs_error(sb,
		"invalid file type bits in mode 0%o for inode %lu",
		inode->i_mode, ino);
		err = -EIO;
		goto failed_unmap;
		}
		nilfs_ifile_unmap_inode(raw_inode);
		brelse(bh);