* Forwarded: Re: [syzbot] [fs?] WARNING in minix_rename
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
@ 2025-07-18 10:59 ` syzbot
2025-10-13 13:38 ` Forwarded: syzbot
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2025-07-18 10:59 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [fs?] WARNING in minix_rename
Author: richard120310@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 78f4e737a53e
Signed-off-by: I Hsin Cheng <richard120310@gmail.com>
---
fs/minix/namei.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..4dfbbfd905d8 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -217,8 +217,13 @@ static int minix_rename(struct mnt_idmap *idmap,
if (err)
goto out_dir;
inode_set_ctime_current(new_inode);
- if (dir_de)
+ if (dir_de) {
drop_nlink(new_inode);
+ if (new_inode->i_nlink == 0) {
+ err = -ESTALE;
+ goto out_dir;
+ }
+ }
inode_dec_link_count(new_inode);
} else {
err = minix_add_link(new_dentry, old_inode);
--
2.43.0
^ permalink raw reply [flat|nested] 8+ messages in thread* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
2025-07-18 10:59 ` Forwarded: " syzbot
@ 2025-10-13 13:38 ` syzbot
2025-10-14 15:24 ` Forwarded: syzbot
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2025-10-13 13:38 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/minix/namei.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..86779a6ec1a7 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -224,7 +224,7 @@ static int minix_rename(struct mnt_idmap *idmap,
err = minix_add_link(new_dentry, old_inode);
if (err)
goto out_dir;
- if (dir_de)
+ if (dir_de && old_dir != new_dir)
inode_inc_link_count(new_dir);
}
@@ -236,7 +236,7 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de) {
err = minix_set_link(dir_de, dir_folio, new_dir);
- if (!err)
+ if (!err && (new_inode || old_dir != new_dir))
inode_dec_link_count(old_dir);
}
out_dir:
--
2.51.0
^ permalink raw reply [flat|nested] 8+ messages in thread* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
2025-07-18 10:59 ` Forwarded: " syzbot
2025-10-13 13:38 ` Forwarded: syzbot
@ 2025-10-14 15:24 ` syzbot
2025-11-02 14:41 ` Forwarded: syzbot
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2025-10-14 15:24 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
fs/minix/inode.c | 14 ++++++++++++++
fs/minix/namei.c | 22 ++++++++++++++--------
2 files changed, 28 insertions(+), 8 deletions(-)
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index f007e389d5d2..e27907fc9bf2 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -517,6 +517,13 @@ static struct inode *V1_minix_iget(struct inode *inode)
iget_failed(inode);
return ERR_PTR(-ESTALE);
}
+ if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+ printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+ inode->i_ino);
+ brelse(bh);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
inode->i_mode = raw_inode->i_mode;
i_uid_write(inode, raw_inode->i_uid);
i_gid_write(inode, raw_inode->i_gid);
@@ -555,6 +562,13 @@ static struct inode *V2_minix_iget(struct inode *inode)
iget_failed(inode);
return ERR_PTR(-ESTALE);
}
+ if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+ printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+ inode->i_ino);
+ brelse(bh);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
inode->i_mode = raw_inode->i_mode;
i_uid_write(inode, raw_inode->i_uid);
i_gid_write(inode, raw_inode->i_gid);
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..8297ee6651a1 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -161,15 +161,21 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
static int minix_rmdir(struct inode * dir, struct dentry *dentry)
{
struct inode * inode = d_inode(dentry);
- int err = -ENOTEMPTY;
-
- if (minix_empty_dir(inode)) {
- err = minix_unlink(dir, dentry);
- if (!err) {
- inode_dec_link_count(dir);
- inode_dec_link_count(inode);
- }
+ int err = -EIO;
+
+ if (dir->i_nlink <= 2)
+ goto out;
+
+ err = -ENOTEMPTY;
+ if (!minix_empty_dir(inode))
+ goto out;
+
+ err = minix_unlink(dir, dentry);
+ if (!err) {
+ inode_dec_link_count(dir);
+ inode_dec_link_count(inode);
}
+out:
return err;
}
--
2.51.0
^ permalink raw reply [flat|nested] 8+ messages in thread* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
` (2 preceding siblings ...)
2025-10-14 15:24 ` Forwarded: syzbot
@ 2025-11-02 14:41 ` syzbot
2025-11-02 14:56 ` Forwarded: syzbot
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2025-11-02 14:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index a8d5a7e22b7b..8648d860ef0c 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -218,6 +218,13 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de && !minix_empty_dir(new_inode))
goto out_dir;
+ err = -EFSCORRUPTED;
+ if (dir_de && new_inode->i_nlink != 2) {
+ printk(KERN_CRIT "minix-fs error: directory inode has "
+ "corrupted nlink");
+ goto out_dir;
+ }
+
err = -ENOENT;
new_de = minix_find_entry(new_dentry, &new_folio);
if (!new_de)
^ permalink raw reply [flat|nested] 8+ messages in thread* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
` (3 preceding siblings ...)
2025-11-02 14:41 ` Forwarded: syzbot
@ 2025-11-02 14:56 ` syzbot
2025-11-02 15:50 ` Forwarded: syzbot
2025-11-02 16:58 ` Forwarded: syzbot
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2025-11-02 14:56 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
#endif
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index a8d5a7e22b7b..8648d860ef0c 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -218,6 +218,13 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de && !minix_empty_dir(new_inode))
goto out_dir;
+ err = -EFSCORRUPTED;
+ if (dir_de && new_inode->i_nlink != 2) {
+ printk(KERN_CRIT "minix-fs error: directory inode has "
+ "corrupted nlink");
+ goto out_dir;
+ }
+
err = -ENOENT;
new_de = minix_find_entry(new_dentry, &new_folio);
if (!new_de)
^ permalink raw reply [flat|nested] 8+ messages in thread* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
` (4 preceding siblings ...)
2025-11-02 14:56 ` Forwarded: syzbot
@ 2025-11-02 15:50 ` syzbot
2025-11-02 16:58 ` Forwarded: syzbot
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2025-11-02 15:50 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
#endif
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..493a75eff2c9 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -208,6 +218,13 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de && !minix_empty_dir(new_inode))
goto out_dir;
+ err = -EFSCORRUPTED;
+ if (new_inode->i_nlink == 0 || (dir_de && new_inode->i_nlink != 2)) {
+ printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
+ "has corrupted nlink", new_inode->i_ino);
+ goto out_dir;
+ }
+
err = -ENOENT;
new_de = minix_find_entry(new_dentry, &new_folio);
if (!new_de)
^ permalink raw reply [flat|nested] 8+ messages in thread* Forwarded:
2025-06-24 17:02 [syzbot] [fs?] WARNING in minix_rename syzbot
` (5 preceding siblings ...)
2025-11-02 15:50 ` Forwarded: syzbot
@ 2025-11-02 16:58 ` syzbot
6 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2025-11-02 16:58 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: jkoolstra@xs4all.nl
#syz test
---
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
#endif
+#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
+
#endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index a8d5a7e22b7b..f18f7474aca4 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -145,6 +145,12 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
struct minix_dir_entry * de;
int err;
+ if (inode->i_nlink < 1) {
+ printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
+ "has corrupted nlink", inode->i_ino);
+ return -EFSCORRUPTED;
+ }
+
de = minix_find_entry(dentry, &folio);
if (!de)
return -ENOENT;
@@ -218,6 +224,13 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de && !minix_empty_dir(new_inode))
goto out_dir;
+ err = -EFSCORRUPTED;
+ if (new_inode->i_nlink == 0 || (dir_de && new_inode->i_nlink != 2)) {
+ printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
+ "has corrupted nlink", new_inode->i_ino);
+ goto out_dir;
+ }
+
err = -ENOENT;
new_de = minix_find_entry(new_dentry, &new_folio);
if (!new_de)
^ permalink raw reply [flat|nested] 8+ messages in thread