diff options
| author | Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com> | 2026-10-16 18:58:51 +0700 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-10-30 16:05:28 +0100 |
| commit | fc9577079df8a44ccbf39d2f06634017d286e4f0 (patch) | |
| tree | b4a4b50935d1b8602fa82ab057126b8207c48e95 | |
| parent | f3a6dae67c9ca3d913cbb42fe324c9b47c8d9e53 (diff) | |
| download | linux-fc9577079df8a44ccbf39d2f06634017d286e4f0.tar.gz linux-fc9577079df8a44ccbf39d2f06634017d286e4f0.zip | |
minix: reject rmdir of a directory with a corrupted link count
minix_rmdir() calls minix_unlink(), which drops the victim's link
count once, and then drops it a second time for the "." entry. An
image where an empty directory has i_nlink < 2 makes the second drop
hit drop_nlink() with i_nlink == 0:
WARNING: fs/inode.c:408 at drop_nlink
minix_rmdir+0xe9/0x150
vfs_rmdir
filename_rmdir
__do_sys_unlinkat
The parent's link count is already validated; do the same for the
directory being removed and fail with -EFSCORRUPTED.
Reported-by: syzbot+8420e667af06b1709c00@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8420e667af06b1709c00
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Link: https://patch.msgid.link/20261016115851.14276-1-ngocthang2710.1999@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
| -rw-r--r-- | fs/minix/namei.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/minix/namei.c b/fs/minix/namei.c index f450b11b9860..64c4636951f2 100644 --- a/fs/minix/namei.c +++ b/fs/minix/namei.c @@ -172,6 +172,10 @@ static int minix_rmdir(struct inode * dir, struct dentry *dentry) minix_error_inode(dir, "inode has corrupted nlink"); goto out; } + if (inode->i_nlink < 2) { + minix_error_inode(inode, "inode has corrupted nlink"); + goto out; + } err = -ENOTEMPTY; if (!minix_empty_dir(inode)) |