If an inode has no links, we need to mark it bad rather than allowing it to be accessed. This avoids WARNINGs in inc_nlink() and drop_nlink() when doing directory operations on a fuzzed filesystem.
Unified · Split
| @@ -468,6 +468,13 @@ static struct inode *V1_minix_iget(struct inode *inode) · 467 unmodified lines | |||
| 468 | iget_failed(inode); | 468 | iget_failed(inode); |
| 469 | return ERR_PTR(-EIO); | 469 | return ERR_PTR(-EIO); |
| 470 | } | 470 | } |
| 471 | if (raw_inode->i_nlinks == 0) { | ||
| 472 | printk("MINIX-fs: deleted inode referenced: %lu\n", | ||
| 473 | inode->i_ino); | ||
| 474 | brelse(bh); | ||
| 475 | iget_failed(inode); | ||
| 476 | return ERR_PTR(-ESTALE); | ||
| 477 | } | ||
| 471 | inode->i_mode = raw_inode->i_mode; | 478 | inode->i_mode = raw_inode->i_mode; |
| 472 | i_uid_write(inode, raw_inode->i_uid); | 479 | i_uid_write(inode, raw_inode->i_uid); |
| 473 | i_gid_write(inode, raw_inode->i_gid); | 480 | i_gid_write(inode, raw_inode->i_gid); |
| @@ -501,6 +508,13 @@ static struct inode *V2_minix_iget(struct inode *inode) · 27 unmodified lines | |||
| 501 | iget_failed(inode); | 508 | iget_failed(inode); |
| 502 | return ERR_PTR(-EIO); | 509 | return ERR_PTR(-EIO); |
| 503 | } | 510 | } |
| 511 | if (raw_inode->i_nlinks == 0) { | ||
| 512 | printk("MINIX-fs: deleted inode referenced: %lu\n", | ||
| 513 | inode->i_ino); | ||
| 514 | brelse(bh); | ||
| 515 | iget_failed(inode); | ||
| 516 | return ERR_PTR(-ESTALE); | ||
| 517 | } | ||
| 504 | inode->i_mode = raw_inode->i_mode; | 518 | inode->i_mode = raw_inode->i_mode; |
| 505 | i_uid_write(inode, raw_inode->i_uid); | 519 | i_uid_write(inode, raw_inode->i_uid); |
| 506 | i_gid_write(inode, raw_inode->i_gid); | 520 | i_gid_write(inode, raw_inode->i_gid); |