github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 13:14:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

block: reject block device inodes with i_rdev == 0 in lookup_bdev()

Browse Source 
lookup_bdev() blindly returns inode->i_rdev without validating it.
When a FUSE filesystem exposes a root inode with S_IFBLK mode but
i_rdev == 0 (via rootmode=060000), any subsequent mount attempt using
that path as a block device source propagates dev_t 0 into the
superblock machinery.  After commit 9ee5f161a4 ("fs: maintain a
global device-to-superblock table") this triggers a WARNING in
super_dev_register().

Reject i_rdev == 0 early with -ENODEV since no real block device
driver registers major 0.

Reported-by: syzbot+72fe3ea5814121fbc76e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=72fe3ea5814121fbc76e
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Link: https://patch.msgid.link/20260703065548.1135125-1-yun.zhou@windriver.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Yun Zhou 2026-07-03 14:55:48 +08:00 committed by Christian Brauner
parent 041a0885f7
commit 83887ad02f
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
block/bdev.c
View File

@ -1278,6 +1278,18 @@ int lookup_bdev(const char *pathname, dev_t *dev)
if (!may_open_dev(&path))
goto out_path_put;
/*
* Reject a block device inode with i_rdev == 0. A dev_t of 0 is
* never valid for a block device: no real block device driver
* registers major 0. Fake block device inodes (e.g. fuse with
* rootmode=S_IFBLK) can expose i_rdev == 0, and letting that
* propagate would confuse superblock lookup and trigger warnings
* in the device-to-superblock table (super_dev_register).
*/
error = -ENODEV;
if (!inode->i_rdev)
goto out_path_put;
*dev = inode->i_rdev;
error = 0;
out_path_put: