| Message ID | 20250211071725.457343-1-chao@kernel.org (mailing list archive) |
|---|---|
| State | Superseded |
| Commit | 6e3019906688765028cf34258380ddbbd7bfc50f |
| Headers | show |
| Series | [f2fs-dev,v3,RESEND] f2fs: add check for deleted inode | expand |
Hello: This patch was applied to jaegeuk/f2fs.git (dev) by Jaegeuk Kim <jaegeuk@kernel.org>: On Tue, 11 Feb 2025 15:17:25 +0800 you wrote: > From: Leo Stone <leocstone@gmail.com> > > The syzbot reproducer mounts a f2fs image, then tries to unlink an > existing file. However, the unlinked file already has a link count of 0 > when it is read for the first time in do_read_inode(). > > Add a check to sanity_check_inode() for i_nlink == 0. > > [...] Here is the summary with links: - [f2fs-dev,v3,RESEND] f2fs: add check for deleted inode https://git.kernel.org/jaegeuk/f2fs/c/6e3019906688 You are awesome, thank you!
On 02/11, Chao Yu wrote: > From: Leo Stone <leocstone@gmail.com> > > The syzbot reproducer mounts a f2fs image, then tries to unlink an > existing file. However, the unlinked file already has a link count of 0 > when it is read for the first time in do_read_inode(). > > Add a check to sanity_check_inode() for i_nlink == 0. > > [Chao Yu: rebase the code] > Reported-by: syzbot+b01a36acd7007e273a83@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=b01a36acd7007e273a83 > Fixes: 39a53e0ce0df ("f2fs: add superblock and major in-memory structure") > Signed-off-by: Leo Stone <leocstone@gmail.com> > Signed-off-by: Chao Yu <chao@kernel.org> > --- > - no logic change, just rebase the code to last dev-test branch > fs/f2fs/inode.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c > index d6ad7810df69..543fb942bec1 100644 > --- a/fs/f2fs/inode.c > +++ b/fs/f2fs/inode.c > @@ -386,6 +386,12 @@ static bool sanity_check_inode(struct inode *inode, struct page *node_page) > } > } > > + if (inode->i_nlink == 0) { > + f2fs_warn(sbi, "%s: inode (ino=%lx) has a link count of 0", > + __func__, inode->i_ino); > + return false; > + } This gives a wrong EFSCORRUPTED when recoverying orphan inodes. f2fs_recover_orphan_inodes -> f2fs_iget_retry -> orphan inode can have i_nlink = 0. > + > return true; > } > > -- > 2.48.1.502.g6dc24dfdaf-goog
On 2/12/25 11:24, Jaegeuk Kim wrote: > On 02/11, Chao Yu wrote: >> From: Leo Stone <leocstone@gmail.com> >> >> The syzbot reproducer mounts a f2fs image, then tries to unlink an >> existing file. However, the unlinked file already has a link count of 0 >> when it is read for the first time in do_read_inode(). >> >> Add a check to sanity_check_inode() for i_nlink == 0. >> >> [Chao Yu: rebase the code] >> Reported-by: syzbot+b01a36acd7007e273a83@syzkaller.appspotmail.com >> Closes: https://syzkaller.appspot.com/bug?extid=b01a36acd7007e273a83 >> Fixes: 39a53e0ce0df ("f2fs: add superblock and major in-memory structure") >> Signed-off-by: Leo Stone <leocstone@gmail.com> >> Signed-off-by: Chao Yu <chao@kernel.org> >> --- >> - no logic change, just rebase the code to last dev-test branch >> fs/f2fs/inode.c | 6 ++++++ >> 1 file changed, 6 insertions(+) >> >> diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c >> index d6ad7810df69..543fb942bec1 100644 >> --- a/fs/f2fs/inode.c >> +++ b/fs/f2fs/inode.c >> @@ -386,6 +386,12 @@ static bool sanity_check_inode(struct inode *inode, struct page *node_page) >> } >> } >> >> + if (inode->i_nlink == 0) { >> + f2fs_warn(sbi, "%s: inode (ino=%lx) has a link count of 0", >> + __func__, inode->i_ino); >> + return false; >> + } > > This gives a wrong EFSCORRUPTED when recoverying orphan inodes. Correct, I noticed that it may fail generic/417, let me fix this. Thanks, > > f2fs_recover_orphan_inodes > -> f2fs_iget_retry > -> orphan inode can have i_nlink = 0. > >> + >> return true; >> } >> >> -- >> 2.48.1.502.g6dc24dfdaf-goog
diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index d6ad7810df69..543fb942bec1 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -386,6 +386,12 @@ static bool sanity_check_inode(struct inode *inode, struct page *node_page) } } + if (inode->i_nlink == 0) { + f2fs_warn(sbi, "%s: inode (ino=%lx) has a link count of 0", + __func__, inode->i_ino); + return false; + } + return true; }