Skip to content

Commit e805b35

Browse files
zhouyun1306kernel-patches-daemon
authored andcommitted
block: reject block device inodes with i_rdev == 0 in lookup_bdev()
lookup_bdev() blindly returns inode->i_rdev without validating it. When a FUSE filesystem exposes a root inode with S_IFBLK mode but i_rdev == 0 (via rootmode=060000), any subsequent mount attempt using that path as a block device source propagates dev_t 0 into the superblock machinery. After commit 9ee5f161a4db ("fs: maintain a global device-to-superblock table") this triggers a WARNING in super_dev_register(). Reject i_rdev == 0 early with -ENODEV since no real block device driver registers major 0. Reported-by: syzbot+72fe3ea5814121fbc76e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=72fe3ea5814121fbc76e Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
1 parent d52f35a commit e805b35

1 file changed

Lines changed: 12 additions & 0 deletions

File tree

block/bdev.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1217,6 +1217,18 @@ int lookup_bdev(const char *pathname, dev_t *dev)
12171217
if (!may_open_dev(&path))
12181218
goto out_path_put;
12191219

1220+
/*
1221+
* Reject a block device inode with i_rdev == 0. A dev_t of 0 is
1222+
* never valid for a block device: no real block device driver
1223+
* registers major 0. Fake block device inodes (e.g. fuse with
1224+
* rootmode=S_IFBLK) can expose i_rdev == 0, and letting that
1225+
* propagate would confuse superblock lookup and trigger warnings
1226+
* in the device-to-superblock table (super_dev_register).
1227+
*/
1228+
error = -ENODEV;
1229+
if (!inode->i_rdev)
1230+
goto out_path_put;
1231+
12201232
*dev = inode->i_rdev;
12211233
error = 0;
12221234
out_path_put:

0 commit comments

Comments
 (0)