tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

udf: Verify inode link counts before performing rename

Browse Source 
BugLink: https://bugs.launchpad.net/bugs/2103869

[ Upstream commit 6756af923e06aa33ad8894aaecbf9060953ba00f ]

During rename, we are updating link counts of various inodes either when
rename deletes target or when moving directory across directories.
Verify involved link counts are sane so that we don't trip warnings in
VFS.

Reported-by: syzbot+3ff7365dc04a6bcafa66@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Manuel Diewald <manuel.diewald@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
This commit is contained in:
Jan Kara
2024-11-26 12:55:12 +01:00
committed by Mehmet Basaran
parent 55273271b0
commit 4d9f4f220d
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/udf/namei.c
+10
View File
@@ -788,8 +788,18 @@ static int udf_rename(struct mnt_idmap *idmap, struct inode *old_dir,
retval = -ENOTEMPTY;
if (!empty_dir(new_inode))
goto out_oiter;
retval = -EFSCORRUPTED;
if (new_inode->i_nlink != 2)
goto out_oiter;
}
retval = -EFSCORRUPTED;
if (old_dir->i_nlink < 3)
goto out_oiter;
is_dir = true;
} else if (new_inode) {
retval = -EFSCORRUPTED;
if (new_inode->i_nlink < 1)
goto out_oiter;
}
if (is_dir && old_dir != new_dir) {
retval = udf_fiiter_find_entry(old_inode, &dotdot_name,