superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix a drop_nlink warning in minix_rename 

Syzbot found a drop_nlink warning that is triggered by an easy to
detect nlink corruption. This patch adds sanity checks to minix_unlink
and minix_rename to prevent the warning and instead return EFSCORRUPTED
to the caller.

The changes were tested using the syzbot reproducer as well as local
testing.

Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
Link: https://patch.msgid.link/20251104143005.3283980-4-jkoolstra@xs4all.nl
Reviewed-by: Jan Kara <jack@suse.cz>
Reported-by: syzbot+a65e824272c5f741247d@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=a65e824272c5f741247d
Signed-off-by: Christian Brauner <brauner@kernel.org>
pull/1354/merge
Jori Koolstra 2025-11-04 15:30:05 +01:00 committed by Christian Brauner
parent d3e0e8661c
commit 009a2ba403
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
fs/minix/namei.c
View File

@ -145,6 +145,11 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
struct minix_dir_entry * de; struct minix_dir_entry * de;
int err; int err;
if (inode->i_nlink == 0) {
minix_error_inode(inode, "inode has corrupted nlink");
return -EFSCORRUPTED;
}
de = minix_find_entry(dentry, &folio); de = minix_find_entry(dentry, &folio);
if (!de) if (!de)
return -ENOENT; return -ENOENT;
@ -217,6 +222,17 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de && !minix_empty_dir(new_inode)) if (dir_de && !minix_empty_dir(new_inode))
goto out_dir; goto out_dir;
err = -EFSCORRUPTED;
if (new_inode->i_nlink == 0 || (dir_de && new_inode->i_nlink != 2)) {
minix_error_inode(new_inode, "inode has corrupted nlink");
goto out_dir;
}
if (dir_de && old_dir->i_nlink <= 2) {
minix_error_inode(old_dir, "inode has corrupted nlink");
goto out_dir;
}
err = -ENOENT; err = -ENOENT;
new_de = minix_find_entry(new_dentry, &new_folio); new_de = minix_find_entry(new_dentry, &new_folio);
if (!new_de) if (!new_de)