github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

minix: reject rmdir of a directory with a corrupted link count

Browse Source 
minix_rmdir() calls minix_unlink(), which drops the victim's link
count once, and then drops it a second time for the "." entry. An
image where an empty directory has i_nlink < 2 makes the second drop
hit drop_nlink() with i_nlink == 0:

  WARNING: fs/inode.c:408 at drop_nlink
   minix_rmdir+0xe9/0x150
   vfs_rmdir
   filename_rmdir
   __do_sys_unlinkat

The parent's link count is already validated; do the same for the
directory being removed and fail with -EFSCORRUPTED.

Reported-by: syzbot+8420e667af06b1709c00@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8420e667af06b1709c00
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Link: https://patch.msgid.link/20261016115851.14276-1-ngocthang2710.1999@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Nguyen Ngoc Thang 2026-10-16 18:58:51 +07:00 committed by Christian Brauner
parent f3a6dae67c
commit fc9577079d
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fs/minix/namei.c
View File

@ -172,6 +172,10 @@ static int minix_rmdir(struct inode * dir, struct dentry *dentry)
minix_error_inode(dir, "inode has corrupted nlink");
goto out;
}
if (inode->i_nlink < 2) {
minix_error_inode(inode, "inode has corrupted nlink");
goto out;
}
err = -ENOTEMPTY;
if (!minix_empty_dir(inode))