cramfs: Verify inode mode when loading from disk

[ Upstream commit 7f9d34b0a7cb93d678ee7207f0634dbf79e47fe5 ]

The inode mode loaded from corrupted disk can be invalid. Do like what
commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
does.

Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/429b3ef1-13de-4310-9a8e-c2dc9a36234a@I-love.SAKURA.ne.jp
Acked-by: Nicolas Pitre <nico@fluxnic.net>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
index 6dae27d6f553f9f07097420f0d0a3bd848d390c7..9979187a4b3c5ec54d2c1caa1cc76ed43d5e1584 100644 (file)
--- a/fs/cramfs/inode.c
+++ b/fs/cramfs/inode.c
@@ -117,9 +117,18 @@ static struct inode *get_cramfs_inode(struct super_block *sb,
                inode_nohighmem(inode);
                inode->i_data.a_ops = &cramfs_aops;
                break;
-       default:
+       case S_IFCHR:
+       case S_IFBLK:
+       case S_IFIFO:
+       case S_IFSOCK:
                init_special_inode(inode, cramfs_inode->mode,
                                old_decode_dev(cramfs_inode->size));
+               break;
+       default:
+               printk(KERN_DEBUG "CRAMFS: Invalid file type 0%04o for inode %lu.\n",
+                      inode->i_mode, inode->i_ino);
+               iget_failed(inode);
+               return ERR_PTR(-EIO);
        }
 
        inode->i_mode = cramfs_inode->mode;