diff options
| author | Jori Koolstra <jkoolstra@xs4all.nl> | 2025-11-04 15:30:04 +0100 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2025-11-05 13:45:21 +0100 |
| commit | d3e0e8661ceb4fe3aab85af3730dbf41240d561f (patch) | |
| tree | e95b93e0ae61e41daedd096cb215ed5724ab83fc | |
| parent | 21215ce7a95ae03891708028a8c805e5dc47395e (diff) | |
Fix a drop_nlink warning in minix_rmdir
Syzbot found a drop_nlink warning that is triggered by an easy to
detect nlink corruption of a directory. This patch adds a sanity check
to minix_rmdir to prevent the warning and instead return EFSCORRUPTED to
the caller.
The changes were tested using the syzbot reproducer as well as local
testing.
Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
Link: https://patch.msgid.link/20251104143005.3283980-3-jkoolstra@xs4all.nl
Reviewed-by: Jan Kara <jack@suse.cz>
Reported-by: syzbot+4e49728ec1cbaf3b91d2@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=4e49728ec1cbaf3b91d2
Signed-off-by: Christian Brauner <brauner@kernel.org>
| -rw-r--r-- | fs/minix/namei.c | 25 |
1 files changed, 17 insertions, 8 deletions
diff --git a/fs/minix/namei.c b/fs/minix/namei.c index 8938536d8d3c..68d2dd75b97f 100644 --- a/fs/minix/namei.c +++ b/fs/minix/namei.c @@ -161,15 +161,24 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry) static int minix_rmdir(struct inode * dir, struct dentry *dentry) { struct inode * inode = d_inode(dentry); - int err = -ENOTEMPTY; - - if (minix_empty_dir(inode)) { - err = minix_unlink(dir, dentry); - if (!err) { - inode_dec_link_count(dir); - inode_dec_link_count(inode); - } + int err = -EFSCORRUPTED; + + if (dir->i_nlink <= 2) { + minix_error_inode(dir, "inode has corrupted nlink"); + goto out; + } + + err = -ENOTEMPTY; + if (!minix_empty_dir(inode)) + goto out; + + err = minix_unlink(dir, dentry); + if (!err) { + inode_dec_link_count(dir); + inode_dec_link_count(inode); } + +out: return err; } |