From b47fb1ed0221fd21e696b468ed9eb40dd3c21f4d Mon Sep 17 00:00:00 2001 From: Eric Sandeen Date: Tue, 13 Oct 2026 16:07:47 -0500 Subject: [PATCH] xfs: add missing cursor stat checks after xfs_btree_delete Three xfs_btree_delete() calls in xfs_ialloc.c fail to check the status returns indicating whether a record was actually deleted. If the cursor was pointing to something that couldn't be deleted or didn't exist, something has gone wrong, so mark the fs as sick and return EFSCORRUPTED. Signed-off-by: Eric Sandeen Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino --- fs/xfs/libxfs/xfs_ialloc.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c index 17699f7c009f..bb6e684f5467 100644 --- a/fs/xfs/libxfs/xfs_ialloc.c +++ b/fs/xfs/libxfs/xfs_ialloc.c @@ -1626,12 +1626,20 @@ xfs_dialloc_ag( */ rec.ir_free &= ~XFS_INOBT_MASK(offset); rec.ir_freecount--; - if (rec.ir_freecount) + if (rec.ir_freecount) { error = xfs_inobt_update(cur, &rec); - else + if (error) + goto error_cur; + } else { error = xfs_btree_delete(cur, &i); - if (error) - goto error_cur; + if (error) + goto error_cur; + if (XFS_IS_CORRUPT(mp, i != 1)) { + xfs_btree_mark_sick(cur); + error = -EFSCORRUPTED; + goto error_cur; + } + } /* * The finobt has now been updated appropriately. We haven't updated the @@ -2164,6 +2172,11 @@ xfs_difree_inobt( __func__, error); goto error0; } + if (XFS_IS_CORRUPT(mp, i != 1)) { + xfs_btree_mark_sick(cur); + error = -EFSCORRUPTED; + goto error0; + } error = xfs_difree_inode_chunk(tp, pag, &rec); if (error) @@ -2290,7 +2303,11 @@ xfs_difree_finobt( error = xfs_btree_delete(cur, &i); if (error) goto error; - ASSERT(i == 1); + if (XFS_IS_CORRUPT(mp, i != 1)) { + xfs_btree_mark_sick(cur); + error = -EFSCORRUPTED; + goto error; + } } else { error = xfs_inobt_update(cur, &rec); if (error)