A crafted ext2 image can provide a directory entry pointing to an inode
with i_links_count == 0 on disk. Calling unlink() on such an entry
triggers WARN_ON inside drop_nlink():
WARNING: CPU: 3 PID: 609 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336
CPU: 3 UID: 0 PID: 609 Comm: syz-executor Not tainted 6.12.77+ #1
Call Trace:
inode_dec_link_count include/linux/fs.h:2518 [inline]
ext2_unlink+0x26c/0x300 fs/ext2/namei.c:295
vfs_unlink+0x2fc/0x9b0 fs/namei.c:4477
do_unlinkat+0x53e/0x730 fs/namei.c:4541
__do_sys_unlink fs/namei.c:4589 [inline]
__se_sys_unlink fs/namei.c:4587 [inline]
__x64_sys_unlink+0xc6/0x110 fs/namei.c:4587
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0xf5/0x220 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x77/0x7f
At the point of the crash, ext2_delete_entry() has already committed
the removal of the directory entry to disk, so returning an error is
not an option. Instead, skip the decrement and report the corruption
via ext2_error(), which marks the superblock as having errors. The
inode will be reclaimed when its last reference is dropped.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Cc: stable@vger.kernel.org
Fixes: a513b035eadf ("[PATCH] ext2: switch to inode_inc_count, inode_dec_count")
Signed-off-by: Vasiliy Kovalev
---
fs/ext2/namei.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/ext2/namei.c b/fs/ext2/namei.c
index bde617a66cec..ea49e8f2b292 100644
--- a/fs/ext2/namei.c
+++ b/fs/ext2/namei.c
@@ -293,7 +293,12 @@ static int ext2_unlink(struct inode *dir, struct dentry *dentry)
goto out;
inode_set_ctime_to_ts(inode, inode_get_ctime(dir));
- inode_dec_link_count(inode);
+ if (!inode->i_nlink)
+ ext2_error(inode->i_sb, __func__,
+ "inode %lu has zero i_nlink on unlink, fs may be corrupt",
+ inode->i_ino);
+ else
+ inode_dec_link_count(inode);
err = 0;
out:
return err;
--
2.50.1