vfs: access must reject invalid masks

Acked-by: Gerd Behrmann
Target: master