The inode's `i_mode` field previously included all 16 bits from the BFS on-disk mode, which combines permission bits (0-11) with file type bits (12-15). However, this approach allowed invalid type bits to propagate, leading to inodes with uninitialized or incorrect fields. As Al Viro noted [1], file types are determined by bits 12-15, which correspond to: - `0x4000` for directories, - `0x8000` for regular files, - other values for different types like FIFOs or symlinks. If the `i_vtype` field does not match a valid file type (e.g., `BFS_VDIR` or `BFS_VREG`), it indicates corruption or an unsupported state in the filesystem. This patch restricts `i_mode` to the lower 12 bits and validates `i_vtype`: - Directories and regular files are handled as expected. - Inodes with invalid `i_vtype` values are discarded, and a warning is logged for debugging. [1] https://lore.kernel.org/linux-unionfs/20241123002157.GP3387508@ZenIV/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+a8c9d476508bd14a90e5@xxxxxxxxxxxxxxxxxxxxxxxxx Closes: https://syzkaller.appspot.com/bug?extid=a8c9d476508bd14a90e5 Suggested-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> Signed-off-by: Vasiliy Kovalev <kovalev@xxxxxxxxxxxx> --- fs/bfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c index db81570c96375..c02efc5724d26 100644 --- a/fs/bfs/inode.c +++ b/fs/bfs/inode.c @@ -60,7 +60,7 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK; di = (struct bfs_inode *)bh->b_data + off; - inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode); + inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode); if (le32_to_cpu(di->i_vtype) == BFS_VDIR) { inode->i_mode |= S_IFDIR; inode->i_op = &bfs_dir_inops; @@ -70,6 +70,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) inode->i_op = &bfs_file_inops; inode->i_fop = &bfs_file_operations; inode->i_mapping->a_ops = &bfs_aops; + } else { + printf("Invalid vtype %u for inode %s:%08lx\n", + le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino); + brelse(bh); + goto error; } BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock); -- 2.33.8
