diff options
| author | Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com> | 2026-10-16 18:58:51 +0700 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-10-30 16:05:28 +0100 |
| commit | fc9577079df8a44ccbf39d2f06634017d286e4f0 (patch) | |
| tree | b4a4b50935d1b8602fa82ab057126b8207c48e95 /tools/lib/python/kdoc/python_version.py | |
| parent | f3a6dae67c9ca3d913cbb42fe324c9b47c8d9e53 (diff) | |
minix: reject rmdir of a directory with a corrupted link count
minix_rmdir() calls minix_unlink(), which drops the victim's link
count once, and then drops it a second time for the "." entry. An
image where an empty directory has i_nlink < 2 makes the second drop
hit drop_nlink() with i_nlink == 0:
WARNING: fs/inode.c:408 at drop_nlink
minix_rmdir+0xe9/0x150
vfs_rmdir
filename_rmdir
__do_sys_unlinkat
The parent's link count is already validated; do the same for the
directory being removed and fail with -EFSCORRUPTED.
Reported-by: syzbot+8420e667af06b1709c00@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8420e667af06b1709c00
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Link: https://patch.msgid.link/20261016115851.14276-1-ngocthang2710.1999@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions