If an inode has no links, we need to mark it bad rather than allowing it to be accessed. This avoids WARNINGs in inc_nlink() and drop_nlink() when doing directory operations on a fuzzed filesystem.
Unified · Split
| @@ -468,6 +468,13 @@ static struct inode *V1_minix_iget(struct inode *inode) · 467 unmodified lines | ||
| 468 | 468 | iget_failed(inode); |
| 469 | 469 | return ERR_PTR(-EIO); |
| 470 | 470 | } |
| 471 | + if (raw_inode->i_nlinks == 0) { | |
| 472 | + printk("MINIX-fs: deleted inode referenced: %lu\n", | |
| 473 | + inode->i_ino); | |
| 474 | + brelse(bh); | |
| 475 | + iget_failed(inode); | |
| 476 | + return ERR_PTR(-ESTALE); | |
| 477 | + } | |
| 471 | 478 | inode->i_mode = raw_inode->i_mode; |
| 472 | 479 | i_uid_write(inode, raw_inode->i_uid); |
| 473 | 480 | i_gid_write(inode, raw_inode->i_gid); |
| @@ -501,6 +508,13 @@ static struct inode *V2_minix_iget(struct inode *inode) · 27 unmodified lines | ||
| 501 | 508 | iget_failed(inode); |
| 502 | 509 | return ERR_PTR(-EIO); |
| 503 | 510 | } |
| 511 | + if (raw_inode->i_nlinks == 0) { | |
| 512 | + printk("MINIX-fs: deleted inode referenced: %lu\n", | |
| 513 | + inode->i_ino); | |
| 514 | + brelse(bh); | |
| 515 | + iget_failed(inode); | |
| 516 | + return ERR_PTR(-ESTALE); | |
| 517 | + } | |
| 504 | 518 | inode->i_mode = raw_inode->i_mode; |
| 505 | 519 | i_uid_write(inode, raw_inode->i_uid); |
| 506 | 520 | i_gid_write(inode, raw_inode->i_gid); |