From fc9577079df8a44ccbf39d2f06634017d286e4f0 Mon Sep 17 00:00:00 2001 From: Nguyen Ngoc Thang Date: Fri, 16 Oct 2026 18:58:51 +0700 Subject: [PATCH] minix: reject rmdir of a directory with a corrupted link count minix_rmdir() calls minix_unlink(), which drops the victim's link count once, and then drops it a second time for the "." entry. An image where an empty directory has i_nlink < 2 makes the second drop hit drop_nlink() with i_nlink == 0: WARNING: fs/inode.c:408 at drop_nlink minix_rmdir+0xe9/0x150 vfs_rmdir filename_rmdir __do_sys_unlinkat The parent's link count is already validated; do the same for the directory being removed and fail with -EFSCORRUPTED. Reported-by: syzbot+8420e667af06b1709c00@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8420e667af06b1709c00 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Nguyen Ngoc Thang Link: https://patch.msgid.link/20261016115851.14276-1-ngocthang2710.1999@gmail.com Signed-off-by: Christian Brauner (Amutable) --- fs/minix/namei.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/minix/namei.c b/fs/minix/namei.c index f450b11b9860..64c4636951f2 100644 --- a/fs/minix/namei.c +++ b/fs/minix/namei.c @@ -172,6 +172,10 @@ static int minix_rmdir(struct inode * dir, struct dentry *dentry) minix_error_inode(dir, "inode has corrupted nlink"); goto out; } + if (inode->i_nlink < 2) { + minix_error_inode(inode, "inode has corrupted nlink"); + goto out; + } err = -ENOTEMPTY; if (!minix_empty_dir(inode))