[PATCH] bfs: validate inode vtype and discard invalid entries

[Vasiliy Kovalev]

The inode's `i_mode` field previously included all 16 bits from the
BFS on-disk mode, which combines permission bits (0-11) with file type
bits (12-15).
However, this approach allowed invalid type bits to propagate, leading
to inodes with uninitialized or incorrect fields.

As Al Viro noted [1], file types are determined by bits 12-15, which
correspond to:
- `0x4000` for directories,
- `0x8000` for regular files,
- other values for different types like FIFOs or symlinks.

If the `i_vtype` field does not match a valid file type (e.g., `BFS_VDIR`
or `BFS_VREG`), it indicates corruption or an unsupported state in the
filesystem.

This patch restricts `i_mode` to the lower 12 bits and validates `i_vtype`:
- Directories and regular files are handled as expected.
- Inodes with invalid `i_vtype` values are discarded, and a warning is
logged for debugging.

[1] https://lore.kernel.org/linux-unionfs/20241123002157.GP3387508@ZenIV/

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+a8c9d476508bd14a90e5@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=a8c9d476508bd14a90e5
Suggested-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Vasiliy Kovalev <kovalev@xxxxxxxxxxxx>
---
 fs/bfs/inode.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
index db81570c96375..c02efc5724d26 100644
--- a/fs/bfs/inode.c
+++ b/fs/bfs/inode.c
@@ -60,7 +60,7 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
 	off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
 	di = (struct bfs_inode *)bh->b_data + off;
 
-	inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode);
+	inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode);
 	if (le32_to_cpu(di->i_vtype) == BFS_VDIR) {
 		inode->i_mode |= S_IFDIR;
 		inode->i_op = &bfs_dir_inops;
@@ -70,6 +70,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
 		inode->i_op = &bfs_file_inops;
 		inode->i_fop = &bfs_file_operations;
 		inode->i_mapping->a_ops = &bfs_aops;
+	} else {
+		printf("Invalid vtype %u for inode %s:%08lx\n",
+			le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino);
+		brelse(bh);
+		goto error;
 	}
 
 	BFS_I(inode)->i_sblock =  le32_to_cpu(di->i_sblock);
-- 
2.33.8