[PATCH] gfs2: validate file type in glockfd iterator

[Hongling Zeng]

The gfs2_glockfd_seq_show_flock() function assumes all file descriptors
with inodes on the GFS2 superblock have file->private_data pointing to
struct gfs2_file. This is incorrect for:

- O_PATH files: private_data is NULL
- Special files (FIFO, socket, device): private_data points to
  different structures

The glockfd iterator only checks that the inode's superblock matches,
which allows these files to pass through. This can lead to NULL pointer
dereference or invalid private_data access when accessing private_data.

Add an f_op check so we only process files using gfs2_file_fops before
accessing private_data.

Fixes: 56535dc695f8 ("gfs2: Add flocks to glockfd debugfs file")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
---
 fs/gfs2/glock.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index d59ea71a84db..b210c97cde45 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -2562,10 +2562,16 @@ static void gfs2_glockfd_seq_stop(struct seq_file *seq, void *iter_ptr)
 static void gfs2_glockfd_seq_show_flock(struct seq_file *seq,
 					struct gfs2_glockfd_iter *i)
 {
-	struct gfs2_file *fp = i->file->private_data;
-	struct gfs2_holder *fl_gh = &fp->f_fl_gh;
+	struct gfs2_file *fp;
+	struct gfs2_holder *fl_gh;
 	struct lm_lockname gl_name = { .ln_type = LM_TYPE_RESERVED };
 
+	if (i->file->f_op != &gfs2_file_fops)
+		return;
+
+	fp = i->file->private_data;
+	fl_gh = &fp->f_fl_gh;
+
 	if (!READ_ONCE(fl_gh->gh_gl))
 		return;
 
-- 
2.25.1