superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix a drop_nlink warning in minix_rmdir 

Syzbot found a drop_nlink warning that is triggered by an easy to
detect nlink corruption of a directory. This patch adds a sanity check
to minix_rmdir to prevent the warning and instead return EFSCORRUPTED to
the caller.

The changes were tested using the syzbot reproducer as well as local
testing.

Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
Link: https://patch.msgid.link/20251104143005.3283980-3-jkoolstra@xs4all.nl
Reviewed-by: Jan Kara <jack@suse.cz>
Reported-by: syzbot+4e49728ec1cbaf3b91d2@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=4e49728ec1cbaf3b91d2
Signed-off-by: Christian Brauner <brauner@kernel.org>
pull/1354/merge
Jori Koolstra 2025-11-04 15:30:04 +01:00 committed by Christian Brauner
parent 21215ce7a9
commit d3e0e8661c
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
fs/minix/namei.c
View File

@ -161,15 +161,24 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
static int minix_rmdir(struct inode * dir, struct dentry *dentry)
{
struct inode * inode = d_inode(dentry);
int err = -ENOTEMPTY;
int err = -EFSCORRUPTED;
if (minix_empty_dir(inode)) {
err = minix_unlink(dir, dentry);
if (!err) {
inode_dec_link_count(dir);
inode_dec_link_count(inode);
}
if (dir->i_nlink <= 2) {
minix_error_inode(dir, "inode has corrupted nlink");
goto out;
}
err = -ENOTEMPTY;
if (!minix_empty_dir(inode))
goto out;
err = minix_unlink(dir, dentry);
if (!err) {
inode_dec_link_count(dir);
inode_dec_link_count(inode);
}
out:
return err;
}