From: Yun Zhou Date: Fri, 3 Jul 2026 06:55:48 +0000 (+0800) Subject: block: reject block device inodes with i_rdev == 0 in lookup_bdev() X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=83887ad02f30c1814bed5da3ca999f7b0f3f337c;p=thirdparty%2Flinux.git block: reject block device inodes with i_rdev == 0 in lookup_bdev() lookup_bdev() blindly returns inode->i_rdev without validating it. When a FUSE filesystem exposes a root inode with S_IFBLK mode but i_rdev == 0 (via rootmode=060000), any subsequent mount attempt using that path as a block device source propagates dev_t 0 into the superblock machinery. After commit 9ee5f161a4db ("fs: maintain a global device-to-superblock table") this triggers a WARNING in super_dev_register(). Reject i_rdev == 0 early with -ENODEV since no real block device driver registers major 0. Reported-by: syzbot+72fe3ea5814121fbc76e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=72fe3ea5814121fbc76e Signed-off-by: Yun Zhou Link: https://patch.msgid.link/20260703065548.1135125-1-yun.zhou@windriver.com Signed-off-by: Christian Brauner (Amutable) --- diff --git a/block/bdev.c b/block/bdev.c index 28b0d40c362f..797d7f0ef609 100644 --- a/block/bdev.c +++ b/block/bdev.c @@ -1278,6 +1278,18 @@ int lookup_bdev(const char *pathname, dev_t *dev) if (!may_open_dev(&path)) goto out_path_put; + /* + * Reject a block device inode with i_rdev == 0. A dev_t of 0 is + * never valid for a block device: no real block device driver + * registers major 0. Fake block device inodes (e.g. fuse with + * rootmode=S_IFBLK) can expose i_rdev == 0, and letting that + * propagate would confuse superblock lookup and trigger warnings + * in the device-to-superblock table (super_dev_register). + */ + error = -ENODEV; + if (!inode->i_rdev) + goto out_path_put; + *dev = inode->i_rdev; error = 0; out_path_put: