erofs: ensure regular inodes for file-backed mounts

Only regular inodes are allowed for file-backed mounts, not directories
(as seen in the original syzbot case) or special inodes.

Also ensure that .read_folio() is implemented on the underlying fs
for the primary device.

Fixes: fb176750266a ("erofs: add file-backed mount support")
Reported-by: syzbot+001306cd9c92ce0df23f@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/00000000000011bdde0622498ee3@google.com
Tested-by: syzbot+001306cd9c92ce0df23f@syzkaller.appspotmail.com
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://lore.kernel.org/r/20240917130803.32418-1-hsiangkao@linux.alibaba.com

diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index 666873f745dab2c8ca926e8b7d4a6afef3a1d50f..320d586c389626ac024fd8d884f8aec688554337 100644 (file)
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -191,10 +191,14 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,
                if (IS_ERR(file))
                        return PTR_ERR(file);
 
-               dif->file = file;
-               if (!erofs_is_fileio_mode(sbi))
+               if (!erofs_is_fileio_mode(sbi)) {
                        dif->dax_dev = fs_dax_get_by_bdev(file_bdev(file),
                                        &dif->dax_part_off, NULL, NULL);
+               } else if (!S_ISREG(file_inode(file)->i_mode)) {
+                       fput(file);
+                       return -EINVAL;
+               }
+               dif->file = file;
        }
 
        dif->blocks = le32_to_cpu(dis->blocks);
@@ -714,7 +718,10 @@ static int erofs_fc_get_tree(struct fs_context *fc)
                if (IS_ERR(sbi->fdev))
                        return PTR_ERR(sbi->fdev);
 
-               return get_tree_nodev(fc, erofs_fc_fill_super);
+               if (S_ISREG(file_inode(sbi->fdev)->i_mode) &&
+                   sbi->fdev->f_mapping->a_ops->read_folio)
+                       return get_tree_nodev(fc, erofs_fc_fill_super);
+               fput(sbi->fdev);
        }
 #endif
        return ret;