cramfs: Verify inode mode when loading from disk

[PATCH] cramfs: Verify inode mode when loading from disk

Posted by Tetsuo Handa 1 month, 3 weeks ago

The inode mode loaded from corrupted disk can be invalid. Do like what
commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
does.

Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
 fs/cramfs/inode.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
index b002e9b734f9..12daa85ed941 100644
--- a/fs/cramfs/inode.c
+++ b/fs/cramfs/inode.c
@@ -116,9 +116,18 @@ static struct inode *get_cramfs_inode(struct super_block *sb,
 		inode_nohighmem(inode);
 		inode->i_data.a_ops = &cramfs_aops;
 		break;
-	default:
+	case S_IFCHR:
+	case S_IFBLK:
+	case S_IFIFO:
+	case S_IFSOCK:
 		init_special_inode(inode, cramfs_inode->mode,
 				old_decode_dev(cramfs_inode->size));
+		break;
+	default:
+		printk(KERN_DEBUG "CRAMFS: Invalid file type 0%04o for inode %lu.\n",
+		       inode->i_mode, inode->i_ino);
+		iget_failed(inode);
+		return ERR_PTR(-EIO);
 	}
 
 	inode->i_mode = cramfs_inode->mode;
-- 
2.50.1

Re: [PATCH] cramfs: Verify inode mode when loading from disk

Posted by Tetsuo Handa 1 month ago

Any questions? Should I find someone who can take this patch?

On 2025/08/12 23:52, Tetsuo Handa wrote:
> The inode mode loaded from corrupted disk can be invalid. Do like what
> commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
> does.
> 
> Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
> Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> ---
>  fs/cramfs/inode.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
> index b002e9b734f9..12daa85ed941 100644
> --- a/fs/cramfs/inode.c
> +++ b/fs/cramfs/inode.c
> @@ -116,9 +116,18 @@ static struct inode *get_cramfs_inode(struct super_block *sb,
>  		inode_nohighmem(inode);
>  		inode->i_data.a_ops = &cramfs_aops;
>  		break;
> -	default:
> +	case S_IFCHR:
> +	case S_IFBLK:
> +	case S_IFIFO:
> +	case S_IFSOCK:
>  		init_special_inode(inode, cramfs_inode->mode,
>  				old_decode_dev(cramfs_inode->size));
> +		break;
> +	default:
> +		printk(KERN_DEBUG "CRAMFS: Invalid file type 0%04o for inode %lu.\n",
> +		       inode->i_mode, inode->i_ino);
> +		iget_failed(inode);
> +		return ERR_PTR(-EIO);
>  	}
>  
>  	inode->i_mode = cramfs_inode->mode;

Re: [PATCH] cramfs: Verify inode mode when loading from disk

Posted by Nicolas Pitre 1 month ago

On Fri, 29 Aug 2025, Tetsuo Handa wrote:

> Any questions? Should I find someone who can take this patch?

Please add

Acked-by: Nicolas Pitre <nico@fluxnic.net>

and send it to linux-fsdevel@vger.kernel.org.

> On 2025/08/12 23:52, Tetsuo Handa wrote:
> > The inode mode loaded from corrupted disk can be invalid. Do like what
> > commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
> > does.
> > 
> > Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
> > Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
> > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> > ---
> >  fs/cramfs/inode.c | 11 ++++++++++-
> >  1 file changed, 10 insertions(+), 1 deletion(-)
> > 
> > diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
> > index b002e9b734f9..12daa85ed941 100644
> > --- a/fs/cramfs/inode.c
> > +++ b/fs/cramfs/inode.c
> > @@ -116,9 +116,18 @@ static struct inode *get_cramfs_inode(struct super_block *sb,
> >  		inode_nohighmem(inode);
> >  		inode->i_data.a_ops = &cramfs_aops;
> >  		break;
> > -	default:
> > +	case S_IFCHR:
> > +	case S_IFBLK:
> > +	case S_IFIFO:
> > +	case S_IFSOCK:
> >  		init_special_inode(inode, cramfs_inode->mode,
> >  				old_decode_dev(cramfs_inode->size));
> > +		break;
> > +	default:
> > +		printk(KERN_DEBUG "CRAMFS: Invalid file type 0%04o for inode %lu.\n",
> > +		       inode->i_mode, inode->i_ino);
> > +		iget_failed(inode);
> > +		return ERR_PTR(-EIO);
> >  	}
> >  
> >  	inode->i_mode = cramfs_inode->mode;
> 
>