@@ -60,7 +60,7 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
di = (struct bfs_inode *)bh->b_data + off;
- inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode);
+ inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode);
if (le32_to_cpu(di->i_vtype) == BFS_VDIR) {
inode->i_mode |= S_IFDIR;
inode->i_op = &bfs_dir_inops;
@@ -70,6 +70,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
inode->i_op = &bfs_file_inops;
inode->i_fop = &bfs_file_operations;
inode->i_mapping->a_ops = &bfs_aops;
+ } else {
+ printf("Invalid vtype %u for inode %s:%08lx\n",
+ le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino);
+ brelse(bh);
+ goto error;
}
BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock);
The inode's `i_mode` field previously included all 16 bits from the BFS on-disk mode, which combines permission bits (0-11) with file type bits (12-15). However, this approach allowed invalid type bits to propagate, leading to inodes with uninitialized or incorrect fields. As Al Viro noted [1], file types are determined by bits 12-15, which correspond to: - `0x4000` for directories, - `0x8000` for regular files, - other values for different types like FIFOs or symlinks. If the `i_vtype` field does not match a valid file type (e.g., `BFS_VDIR` or `BFS_VREG`), it indicates corruption or an unsupported state in the filesystem. This patch restricts `i_mode` to the lower 12 bits and validates `i_vtype`: - Directories and regular files are handled as expected. - Inodes with invalid `i_vtype` values are discarded, and a warning is logged for debugging. [1] https://lore.kernel.org/linux-unionfs/20241123002157.GP3387508@ZenIV/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+a8c9d476508bd14a90e5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a8c9d476508bd14a90e5 Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Cc: <stable@vger.kernel.org> Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org> --- fs/bfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)