linux-kernel - Re: [PATCH] Fix a drop_nlink warning in minix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <kk6kvnjtabdriq6pbxuenltbecjibsvzqg6a3bwdklqad3dxiz@mr7lgm7s45qu>
Date: Tue, 4 Nov 2025 09:03:46 +0100
From: Jan Kara <jack@...e.cz>
To: Jori Koolstra <jkoolstra@...all.nl>
Cc: Christian Brauner <brauner@...nel.org>, 
	Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>, Taotao Chen <chentaotao@...iglobal.com>, 
	Jeff Layton <jlayton@...nel.org>, Jan Kara <jack@...e.cz>, NeilBrown <neil@...wn.name>, 
	linux-kernel@...r.kernel.org, syzbot+a65e824272c5f741247d@...kaller.appspotmail.com
Subject: Re: [PATCH] Fix a drop_nlink warning in minix_rename

On Sun 02-11-25 19:25:32, Jori Koolstra wrote:
> Syzbot found a drop_nlink warning that is triggered by an easy to
> detect nlink corruption. This patch adds sanity checks to minix_unlink
> and minix_rename to prevent the warning and instead return EFSCORRUPTED
> to the caller.
> 
> The changes were tested using the syzbot reproducer as well as local
> testing.
> 
> Signed-off-by: Jori Koolstra <jkoolstra@...all.nl>
> Reported-by: syzbot+a65e824272c5f741247d@...kaller.appspotmail.com
> Closes: https://syzbot.org/bug?extid=a65e824272c5f741247d

Two comments below.

> ---
>  fs/minix/namei.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/fs/minix/namei.c b/fs/minix/namei.c
> index a8d5a7e22b7b..4bc1d9c31284 100644
> --- a/fs/minix/namei.c
> +++ b/fs/minix/namei.c
> @@ -145,6 +145,12 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
>  	struct minix_dir_entry * de;
>  	int err;
>  
> +	if (inode->i_nlink < 1) {

I guess it makes sense to check here for i_nlink == 0 for consistency.

> +		printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
> +		       "has corrupted nlink", inode->i_ino);
> +		return -EFSCORRUPTED;
> +	}
> +
>  	de = minix_find_entry(dentry, &folio);
>  	if (!de)
>  		return -ENOENT;
> @@ -218,6 +224,13 @@ static int minix_rename(struct mnt_idmap *idmap,
>  		if (dir_de && !minix_empty_dir(new_inode))
>  			goto out_dir;
>  
> +		err = -EFSCORRUPTED;
> +		if (new_inode->i_nlink == 0 || (dir_de && new_inode->i_nlink != 2)) {
> +			printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
> +			       "has corrupted nlink", new_inode->i_ino);
> +			goto out_dir;
> +		}
> +
>  		err = -ENOENT;
>  		new_de = minix_find_entry(new_dentry, &new_folio);
>  		if (!new_de)

You should also check that 'old_dir' link count is correct. I.e.
		if (dir_de && old_dir->i_nlink <= 2) {
			error out.
		}

								Honza
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR