diff options
| author | Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> | 2025-08-30 19:01:01 +0900 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-19 16:37:44 +0200 |
| commit | 5211c672ea2490a11ea6a158d5d6a7a05a9c15d3 (patch) | |
| tree | 66fc09560856ad50a3a8af3aec8a8a7c422fa65e | |
| parent | 3b72a03bf5fe3b2cc1a7b9ca3d4a47f73d1189d1 (diff) | |
| download | linux-5211c672ea2490a11ea6a158d5d6a7a05a9c15d3.tar.gz linux-5211c672ea2490a11ea6a158d5d6a7a05a9c15d3.tar.bz2 linux-5211c672ea2490a11ea6a158d5d6a7a05a9c15d3.zip | |
cramfs: Verify inode mode when loading from disk
[ Upstream commit 7f9d34b0a7cb93d678ee7207f0634dbf79e47fe5 ]
The inode mode loaded from corrupted disk can be invalid. Do like what
commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
does.
Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/429b3ef1-13de-4310-9a8e-c2dc9a36234a@I-love.SAKURA.ne.jp
Acked-by: Nicolas Pitre <nico@fluxnic.net>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/cramfs/inode.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c index 56c8005b24a3..ca54bf24b719 100644 --- a/fs/cramfs/inode.c +++ b/fs/cramfs/inode.c @@ -116,9 +116,18 @@ static struct inode *get_cramfs_inode(struct super_block *sb, inode_nohighmem(inode); inode->i_data.a_ops = &cramfs_aops; break; - default: + case S_IFCHR: + case S_IFBLK: + case S_IFIFO: + case S_IFSOCK: init_special_inode(inode, cramfs_inode->mode, old_decode_dev(cramfs_inode->size)); + break; + default: + printk(KERN_DEBUG "CRAMFS: Invalid file type 0%04o for inode %lu.\n", + inode->i_mode, inode->i_ino); + iget_failed(inode); + return ERR_PTR(-EIO); } inode->i_mode = cramfs_inode->mode; |