mirror of
				https://github.com/torvalds/linux.git
				synced 2025-11-04 10:40:15 +02:00 
			
		
		
		
	isofs: Verify inode mode when loading from disk
Verify that the inode mode is sane when loading it from the disk to avoid complaints from VFS about setting up invalid inodes. Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com CC: stable@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/20250709095545.31062-2-jack@suse.cz Acked-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
		
							parent
							
								
									6b89819b06
								
							
						
					
					
						commit
						0a9e740513
					
				
					 1 changed files with 8 additions and 1 deletions
				
			
		| 
						 | 
					@ -1440,9 +1440,16 @@ static int isofs_read_inode(struct inode *inode, int relocated)
 | 
				
			||||||
		inode->i_op = &page_symlink_inode_operations;
 | 
							inode->i_op = &page_symlink_inode_operations;
 | 
				
			||||||
		inode_nohighmem(inode);
 | 
							inode_nohighmem(inode);
 | 
				
			||||||
		inode->i_data.a_ops = &isofs_symlink_aops;
 | 
							inode->i_data.a_ops = &isofs_symlink_aops;
 | 
				
			||||||
	} else
 | 
						} else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
 | 
				
			||||||
 | 
							   S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
 | 
				
			||||||
		/* XXX - parse_rock_ridge_inode() had already set i_rdev. */
 | 
							/* XXX - parse_rock_ridge_inode() had already set i_rdev. */
 | 
				
			||||||
		init_special_inode(inode, inode->i_mode, inode->i_rdev);
 | 
							init_special_inode(inode, inode->i_mode, inode->i_rdev);
 | 
				
			||||||
 | 
						} else {
 | 
				
			||||||
 | 
							printk(KERN_DEBUG "ISOFS: Invalid file type 0%04o for inode %lu.\n",
 | 
				
			||||||
 | 
								inode->i_mode, inode->i_ino);
 | 
				
			||||||
 | 
							ret = -EIO;
 | 
				
			||||||
 | 
							goto fail;
 | 
				
			||||||
 | 
						}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	ret = 0;
 | 
						ret = 0;
 | 
				
			||||||
out:
 | 
					out:
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
		Loading…
	
		Reference in a new issue