nilfs2: reject invalid file types when reading inodes

commit 4aead50caf67e01020c8be1945c3201e8a972a27 upstream.

To prevent inodes with invalid file types from tripping through the vfs
and causing malfunctions or assertion failures, add a missing sanity check
when reading an inode from a block device.  If the file type is not valid,
treat it as a filesystem error.

Link: https://lkml.kernel.org/r/20250710134952.29862-1-konishi.ryusuke@gmail.com
Fixes: 05fe58fdc10d ("nilfs2: inode operations")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index b7873d2fb4eff158f95683a8bb0efc2286b7a268..11201919aa446109656ee6eda16892b241f61dba 100644 (file)
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -517,11 +517,18 @@ static int __nilfs_read_inode(struct super_block *sb,
                inode->i_op = &nilfs_symlink_inode_operations;
                inode_nohighmem(inode);
                inode->i_mapping->a_ops = &nilfs_aops;
-       } else {
+       } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
+                  S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
                inode->i_op = &nilfs_special_inode_operations;
                init_special_inode(
                        inode, inode->i_mode,
                        huge_decode_dev(le64_to_cpu(raw_inode->i_device_code)));
+       } else {
+               nilfs_error(sb,
+                           "invalid file type bits in mode 0%o for inode %lu",
+                           inode->i_mode, ino);
+               err = -EIO;
+               goto failed_unmap;
        }
        nilfs_ifile_unmap_inode(root->ifile, ino, bh);
        brelse(bh);