Commit 169f7f37 authored Aug 11, 2020 by Eric Biggers Committed by Greg Kroah-Hartman Aug 19, 2020

fs/minix: don't allow getting deleted inodes



commit facb03dddec04e4aac1bb2139accdceb04deb1f3 upstream.

If an inode has no links, we need to mark it bad rather than allowing it
to be accessed.  This avoids WARNINGs in inc_nlink() and drop_nlink() when
doing directory operations on a fuzzed filesystem.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Reported-by:  <syzbot+a9ac3de1b5de5fb10efc@syzkaller.appspotmail.com>
Reported-by:  <syzbot+df958cf5688a96ad3287@syzkaller.appspotmail.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Qiujun Huang <anenbupt@gmail.com>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200628060846.682158-3-ebiggers@kernel.org


Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent b846b77f

fs/minix/inode.c

+14 −0

Original line number	Diff line number	Diff line
		@@ -471,6 +471,13 @@ static struct inode V1_minix_iget(struct inode inode)
		iget_failed(inode);
		return ERR_PTR(-EIO);
		}
		if (raw_inode->i_nlinks == 0) {
		printk("MINIX-fs: deleted inode referenced: %lu\n",
		inode->i_ino);
		brelse(bh);
		iget_failed(inode);
		return ERR_PTR(-ESTALE);
		}
		inode->i_mode = raw_inode->i_mode;
		i_uid_write(inode, raw_inode->i_uid);
		i_gid_write(inode, raw_inode->i_gid);
		@@ -504,6 +511,13 @@ static struct inode V2_minix_iget(struct inode inode)
		iget_failed(inode);
		return ERR_PTR(-EIO);
		}
		if (raw_inode->i_nlinks == 0) {
		printk("MINIX-fs: deleted inode referenced: %lu\n",
		inode->i_ino);
		brelse(bh);
		iget_failed(inode);
		return ERR_PTR(-ESTALE);
		}
		inode->i_mode = raw_inode->i_mode;
		i_uid_write(inode, raw_inode->i_uid);
		i_gid_write(inode, raw_inode->i_gid);