averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

fat: avoid parent link count underflow in rmdir

Browse Source 
[ Upstream commit 8cafcb8813 ]

Corrupted FAT images can leave a directory inode with an incorrect
i_nlink (e.g. 2 even though subdirectories exist). rmdir then
unconditionally calls drop_nlink(dir) and can drive i_nlink to 0,
triggering the WARN_ON in drop_nlink().

Add a sanity check in vfat_rmdir() and msdos_rmdir(): only drop the
parent link count when it is at least 3, otherwise report a filesystem
error.

Link: https://lkml.kernel.org/r/20260101111148.1437-1-zhiyuzhang999@gmail.com
Fixes: 9a53c3a783 ("[PATCH] r/o bind mounts: unlink: monitor i_nlink")
Signed-off-by: Zhiyu Zhang <zhiyuzhang999@gmail.com>
Reported-by: Zhiyu Zhang <zhiyuzhang999@gmail.com>
Closes: https://lore.kernel.org/linux-fsdevel/aVN06OKsKxZe6-Kv@casper.infradead.org/T/#t
Tested-by: Zhiyu Zhang <zhiyuzhang999@gmail.com>
Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Jan Kara <jack@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Zhiyu Zhang
2026-02-26 14:59:18 -08:00
committed by Greg Kroah-Hartman
parent a77e945c52
commit 17866f8a08
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/fat/namei_msdos.c
+6 -1
View File
@@ -325,7 +325,12 @@ static int msdos_rmdir(struct inode *dir, struct dentry *dentry)
err = fat_remove_entries(dir, &sinfo); /* and releases bh */
if (err)
goto out;
drop_nlink(dir);
if (dir->i_nlink >= 3)
drop_nlink(dir);
else {
fat_fs_error(sb, "parent dir link count too low (%u)",
dir->i_nlink);
}
clear_nlink(inode);
fat_truncate_time(inode, NULL, S_CTIME);
fs/fat/namei_vfat.c
+6 -1
View File
@@ -803,7 +803,12 @@ static int vfat_rmdir(struct inode *dir, struct dentry *dentry)
err = fat_remove_entries(dir, &sinfo); /* and releases bh */
if (err)
goto out;
drop_nlink(dir);
if (dir->i_nlink >= 3)
drop_nlink(dir);
else {
fat_fs_error(sb, "parent dir link count too low (%u)",
dir->i_nlink);
}
clear_nlink(inode);
fat_truncate_time(inode, NULL, S_ATIME|S_MTIME);