Commit c08994aa authored by Jan Kara's avatar Jan Kara Committed by Wen Zhiwei
Browse files

udf: Verify inode link counts before performing rename 

stable inclusion
from stable-v6.6.70
commit b41d730552840397262294657a2ad8de82aaebd2
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBOHV1

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b41d730552840397262294657a2ad8de82aaebd2



--------------------------------

[ Upstream commit 6756af923e06aa33ad8894aaecbf9060953ba00f ]

During rename, we are updating link counts of various inodes either when
rename deletes target or when moving directory across directories.
Verify involved link counts are sane so that we don't trip warnings in
VFS.

Reported-by: default avatar <syzbot+3ff7365dc04a6bcafa66@syzkaller.appspotmail.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarWen Zhiwei <wenzhiwei@kylinos.cn>
parent ef85e43f

fs/udf/namei.c

+10 −0
Original line number Diff line number Diff line
@@ -792,8 +792,18 @@ static int udf_rename(struct mnt_idmap *idmap, struct inode *old_dir, 
			retval = -ENOTEMPTY;

			if (!empty_dir(new_inode))

				goto out_oiter;

			retval = -EFSCORRUPTED;

			if (new_inode->i_nlink != 2)

				goto out_oiter;

		}

		retval = -EFSCORRUPTED;

		if (old_dir->i_nlink < 3)

			goto out_oiter;

		is_dir = true;

	} else if (new_inode) {

		retval = -EFSCORRUPTED;

		if (new_inode->i_nlink < 1)

			goto out_oiter;

	}

	if (is_dir && old_dir != new_dir) {

		retval = udf_fiiter_find_entry(old_inode, &dotdot_name,