Nguyen Ngoc Thang fc9577079d minix: reject rmdir of a directory with a corrupted link count ... minix_rmdir() calls minix_unlink(), which drops the victim's link count once, and then drops it a second time for the "." entry. An image where an empty directory has i_nlink < 2 makes the second drop hit drop_nlink() with i_nlink == 0: WARNING: fs/inode.c:408 at drop_nlink minix_rmdir+0xe9/0x150 vfs_rmdir filename_rmdir __do_sys_unlinkat The parent's link count is already validated; do the same for the directory being removed and fail with -EFSCORRUPTED. Reported-by: syzbot+8420e667af06b1709c00@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8420e667af06b1709c00 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com> Link: https://patch.msgid.link/20261016115851.14276-1-ngocthang2710.1999@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>		2026-10-30 16:05:28 +01:00
..
bitmap.c	minix: restore uptodate on bitmap buffers before redirtying them	2026-10-22 18:48:36 +02:00
dir.c	minix: Fix data integrity writeout issues	2026-07-27 16:25:33 +02:00
file.c	fs: port ->setattr() to pass const mnt_idmap	2026-09-23 09:19:51 +02:00
inode.c	fs: port ->getattr() to pass const mnt_idmap	2026-09-23 09:19:51 +02:00
itree_common.c	minix: Track metadata bhs in fs-private inode part	2026-03-26 15:03:32 +01:00
itree_v1.c	fs/minix: remove expected error message in block_to_path()	2020-08-12 10:58:00 -07:00
itree_v2.c	fs/minix: remove expected error message in block_to_path()	2020-08-12 10:58:00 -07:00
Kconfig	fs: add CONFIG_BUFFER_HEAD	2023-08-02 09:13:09 -06:00
Makefile
minix.h	fs: port ->getattr() to pass const mnt_idmap	2026-09-23 09:19:51 +02:00
namei.c	minix: reject rmdir of a directory with a corrupted link count	2026-10-30 16:05:28 +01:00