From nobody Tue Dec 2 00:02:26 2025 Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 417E13148C4 for ; Tue, 25 Nov 2025 11:07:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764068827; cv=none; b=PfrKKZf2ODzCCxNQr8C/GKA/+i2dPYng1qTbnesQao9nD4ZJ7EFKrKNabDNgbumrWl0HGX8VEA9yXbAmPwhQCcKbt3kckcWNN2cfzc156trZr36yNfbj6HTb6ueaXv54KjRnW5P8SyAwcM/ZzI3GfnbmTG+6bGdPmeIrToXvbK0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764068827; c=relaxed/simple; bh=L9HPfnmCaa9Wx+qV68LGk57WzAw5+2CezY0Arw9lXZ0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HNU0sRn4s3WrveCzUo7KVoW3rByCuwGes/Q1TWJs+TrXo7lRVZe4zVp82wQRZ+zzza/bfStoiEOtH/WBZFeqyuD5xGhl0Qv7CBO2a/l7hFKC1ijvg7GF+R5qiH6/kARMA0UWOmwhc06lZRXiHnc59tGjw4r/MCQLFKmTbK81X64= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=V/3ZxB/w; arc=none smtp.client-ip=209.85.210.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="V/3ZxB/w" Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-7b7828bf7bcso6591166b3a.2 for ; Tue, 25 Nov 2025 03:07:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764068825; x=1764673625; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=hdqtBr6Mx6sSTGEgWgcW+ye1nlIlewHMmFMpzodq+Tw=; b=V/3ZxB/wI66MxI4etCGRB396pcYFFvt2yLzqZUCjoHpvx1GpW+ouV2r+PAM982h4W+ BRD2cXTU0ha3sNz9wsBo6fre7bo62FmkU65fvwpaa/5UbIJRrUp2iRoJhzYAcTGCgHXI cEjIobVWucm3Cd0wpahE2sj6Yb7ypBxvZSIKfbxSNyZHXGcZaMXqnUp6d95J7KgV8bo1 VmvLYg6ZqCW+VoKbd+wRIiAwOqXvjbZJXWB5dhBV0AUKOdu3ww4HNGosf1RNQ4Gk4Zpl nzxiBKrXNtg+bF2As83uAPFv6Aq9E9nAnp8UxduXDR5PrPVymEgBkGkbd2QdAcHcaCK/ mt9w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764068825; x=1764673625; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=hdqtBr6Mx6sSTGEgWgcW+ye1nlIlewHMmFMpzodq+Tw=; b=ilzMKmTuBhGw0QWQn+KXjVVzvKS117GhCoKeen1iEEaLdLc3cNIbLd3+rFEoCol0eU DSaUfsph/9ajxyN9/Vm2M9L8VnqTjn+N0iDKkVMoQuDAnqPw0c9+7BvvpLoKYjNvHdZY Yv1YOCoP9QngKYYfx0Y89sHqeDWSZhZPTSh1U2usE6HtwJFlQPOXn6N7AS0tluIF1AV8 MJ7LhRUREv9fzmG7gSXWoG5MJSGQ/FX22i2caprmjDoh67pPyl0MKi9U2ASkb27pbxEG m25avQMbJAjKYPfkhIQaf3MVBw2oGBE7AX0aQ3sF/NUFDPUeKzbTbG5wMd323MgqSOw6 YfaQ== X-Forwarded-Encrypted: i=1; AJvYcCV5gLeIuqFk9qj346F5HD/u4Bce9US7Szf0qWgsPE0jMp2x5UC7AAHcchCFzRcnLqGo2AS+j/Qxafp1Gtw=@vger.kernel.org X-Gm-Message-State: AOJu0Yz6XimJCnrIF+0Nr95jp2KMFLfI7glZR9WDpjNlonEdhxBaDJUB ffYW2xn3RmlfjR9oLzc4l8b7Uk6dSiqKGwe0FimaG7Fa/m331NwXr5m0 X-Gm-Gg: ASbGnct4ItNjvWvN2yBpeJgBanBONa4z2b+vDO+4ANsAxpFW8D+MH98ZADeFPFBmUIO xPE6aBe9yXCnRxso8ZXlUlxN2UUfxEKN9AhmJHurMmxD12CZZncRdvFLudpAA2dv6rDFdY5xyo7 xMLSQhac7AaA8trrI2fMgzwTDKxHl/5z7v7rNeBtDHv+xFvTsnaK6ij2ax7dspCxPiy6BOj+5vN 1zmudoi455FFrYLFP6UPWx0QjR8xC4Mz7FiMkTHd8QR8z+oKnaFN1tq91yMb00G67owssz2f8Tt rCTxptJQz2Pd6P/pKvcTPUXzKSwBaW6VU4SuVlL+KqhAhiwy0d3lNXiBdChgNCRk7biSRQ84jJ9 s3IlFWTZkWOTNE1bhSW0QVjoM742gozKemENQ4ltfqRZIeFDMh+2RVNF3Vu70+IOgSwJQTK2dxP EfZR8swaY= X-Google-Smtp-Source: AGHT+IEBoZOJ3Du/HVGBmLdKe9fbLVemr1Gp9nIx/LJjBWtf9/MgyRHnPkMwn9WTCnAD6lZf5wXDWg== X-Received: by 2002:a05:6a20:a111:b0:350:7238:7e30 with SMTP id adf61e73a8af0-3614ed3e0ecmr18830825637.35.1764068825329; Tue, 25 Nov 2025 03:07:05 -0800 (PST) Received: from hsukr3.. ([2405:201:d019:4042:c1a3:cd97:974e:2371]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-7c3f145845csm17743758b3a.61.2025.11.25.03.07.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Nov 2025 03:07:04 -0800 (PST) From: Sukrut Heroorkar To: Jan Kara , linux-kernel@vger.kernel.org (open list) Cc: shuah@kernel.org, david.hunter.linux@gmail.com, Al Viro , Jan Kara , Sukrut Heroorkar Subject: [PATCH 5.15.y 1/2] udf_rename(): only access the child content on cross-directory rename Date: Tue, 25 Nov 2025 16:36:36 +0530 Message-ID: <20251125110638.15758-2-hsukrut3@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251125110638.15758-1-hsukrut3@gmail.com> References: <20251125110638.15758-1-hsukrut3@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Al Viro [ Upstream commit 9d35cebb794bb7be93db76c3383979c7deacfef9 ] We can't really afford locking the source on same-directory rename; currently vfs_rename() tries to do that, but it will have to be changed. The logics in udf_rename() is lazy and goes looking for ".." in source even in same-directory case. It's not hard to get rid of that, leaving that behaviour only for cross-directory case; that VFS can get locks safely (and will keep doing that after the coming changes). Reviewed-by: Jan Kara Signed-off-by: Al Viro Stable-dep-of: 6756af923e06 ("udf: Verify inode link counts before performi= ng rename") Signed-off-by: Sukrut Heroorkar --- fs/udf/namei.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/udf/namei.c b/fs/udf/namei.c index 5e39cbc74524..f4aded54a994 100644 --- a/fs/udf/namei.c +++ b/fs/udf/namei.c @@ -751,7 +751,7 @@ static int udf_rename(struct user_namespace *mnt_userns= , struct inode *old_dir, struct inode *old_inode =3D d_inode(old_dentry); struct inode *new_inode =3D d_inode(new_dentry); struct udf_fileident_iter oiter, niter, diriter; - bool has_diriter =3D false; + bool has_diriter =3D false, is_dir =3D false; int retval; struct kernel_lb_addr tloc; =20 @@ -774,6 +774,9 @@ static int udf_rename(struct user_namespace *mnt_userns= , struct inode *old_dir, if (!empty_dir(new_inode)) goto out_oiter; } + is_dir =3D true; + } + if (is_dir && old_dir !=3D new_dir) { retval =3D udf_fiiter_find_entry(old_inode, &dotdot_name, &diriter); if (retval =3D=3D -ENOENT) { @@ -859,7 +862,9 @@ static int udf_rename(struct user_namespace *mnt_userns= , struct inode *old_dir, cpu_to_lelb(UDF_I(new_dir)->i_location); udf_fiiter_write_fi(&diriter, NULL); udf_fiiter_release(&diriter); + } =20 + if (is_dir) { inode_dec_link_count(old_dir); if (new_inode) inode_dec_link_count(new_inode); --=20 2.43.0 From nobody Tue Dec 2 00:02:26 2025 Received: from mail-pf1-f180.google.com (mail-pf1-f180.google.com [209.85.210.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 201753148C4 for ; Tue, 25 Nov 2025 11:07:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764068832; cv=none; b=R2Fq1pJf95MJWaboidciPfbK4mGl69eeZ9aNNq+hUyiYz0dUAxziRYbApzfsDtwo3jSi1wttDKcGSmInmM8rWug9AqSkguRP2pVtXRee11kcRBT8Yz7NHMeYJDmEVYAFdVeR0Rkp9gZ3jjX6Pxu3iQvxNAJNsJ7lhLJEkrcMkRk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764068832; c=relaxed/simple; bh=ZddRobZkNQIsdKtZOmmyL6mwfTBCgKXxoI3zgPj3KoY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mtqZFS7l7Zu40Ag+v2hvTKfL8TnsWlerVsMOFvmwdesWZFSesaOgCcn/Na8nWKwaRhwQhbFB86myf6tFPsSgl8YT65up49Fqi1CLSN8+z/P6sCkhr7fv1OuUzuidRfSgQa0Qp+kfGrmDO84Zey2LI6ZPopOnBSwYzNQtRxAIYhw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=PK5Sl/t6; arc=none smtp.client-ip=209.85.210.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="PK5Sl/t6" Received: by mail-pf1-f180.google.com with SMTP id d2e1a72fcca58-7b9a98b751eso4262246b3a.1 for ; Tue, 25 Nov 2025 03:07:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764068830; x=1764673630; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=PAooKkpCVcqdiCb1AlPDNbk/qCMgMtFjwSDBb0VRe34=; b=PK5Sl/t6c1qoBj3e5TcIU6TaktmlLkqJX9DNwHvw+AiL4Pl/LtWcEOd6FJ4DPOnyvw Dy5biCDaAwEWWtsCF/qPy0f4ACLqhUzdBVH0Tyc1DqUyzjpoq+IUg06eUIDxaI8CDH/U q75tg+xcCPBXeQvmFSDGKTrXp9Kx1Z2XpgkBdbugIBgONBMNCnfDyf6yAWSfBa9Gf1mS y4hWUSWqRkyNXzhMCcWbtMcXZRblVNbNPz9wF4GVKjh55q1zkH5zX1g71/7aA7L4cubx QEsKpDKsgw9Jsbg5lpI7roMefEulM7miBvBXqrr0xo19WY0EUnBGvqbmQ26ROMNaYG2I t4GA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764068830; x=1764673630; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=PAooKkpCVcqdiCb1AlPDNbk/qCMgMtFjwSDBb0VRe34=; b=L2M2CQJlQAvhVZGBV5SJLTeqZZjh1gx1rwi+4b+7yhKfwq9gVVDNNuknprDj4BrzaR AuqIsbRvHt7FfEY3G1pDCoY1cA3YvtCLsm3PGtIy5Aj9gr3AQI6gREY4t6m+V5yGjIuB GeGkJfLYQFwbZ3213SUT3i2pbPdNrJF2AiHmPftVfsWCRb25odvJEx5SbTUnDT/2uBdd FIEGzTrF9b/M0ng1/DEpdze9TWsvFfX5byUQaF2IV5FaQVJFbaHIxs/B2LItXThO3BA5 MEquwO5+nvI4qNX8tM4YfUYU7qJqaJdoHbny0YjROGXhbhRKh3U3E35i1G9bV7OIJaEC bvBw== X-Forwarded-Encrypted: i=1; AJvYcCXKW8GrheCUzkZl2M/6QniYwRwNTdxT7PXcLr+45CqCfBBJfovEQDYZABSPAe+L07CGtFj0NL7lg2tcP7g=@vger.kernel.org X-Gm-Message-State: AOJu0YxOyvzUXJxMG0jdxz1Ox+ls5VoYqdjjU6ESc6inwLSTEl5Idpls DczsZEZLswGpehS0TFCVqmCrKGUJftXqs2xMzVRKwBPymVY2qzJWoT6m X-Gm-Gg: ASbGncvSbtqE171mLm0BG4gmGuu9Nx3LqHLnOTtyqyZRgvDZnGcklM+6FGKVWwzjf0H 842qc6P7zhYKPVdFvcgFq/HAr/AJGiD68tCs6UyodHdOQVcWTEx2ciK2PTdvUmYxR2BpnlIf3rB RUR0PhT5XaqKPqunpG0BbCY2piOsjCvGvYbtooQ1NDneKqyxLqEquELP9ywGRo2yvh8FlBnJuuK 917u8tPCbtGMCQAO45RqCAtc2webWkgK8+C2uPxyOchJvNxpZ/DxomsyvrjTthcsaYOCEdY3Wgl /TV5lpR0UESj29lJ6RKhKQYj/OX0P5q20+/JFhigxJo/6ajCs+TyHdI1ZDFUegFDP65Fjq70r/a vP2kJTNNlerqrIcMr8oYYYrKke2g/nWM8kb/v7U3Uza87j+GtMlvLv6ipoEbgVcSL8vHYIwEJyN 9I99zPpB0= X-Google-Smtp-Source: AGHT+IEa2r/ERgQWSKMF1DXTmdYOu1hn/4T3+MrVqq8fQ6rso/F4lJCtoyu26Q7d/n603A1/v1MC5w== X-Received: by 2002:a05:6a00:3e0b:b0:7ac:1444:6779 with SMTP id d2e1a72fcca58-7ca8946d2c7mr2106251b3a.11.1764068830336; Tue, 25 Nov 2025 03:07:10 -0800 (PST) Received: from hsukr3.. ([2405:201:d019:4042:c1a3:cd97:974e:2371]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-7c3f145845csm17743758b3a.61.2025.11.25.03.07.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Nov 2025 03:07:09 -0800 (PST) From: Sukrut Heroorkar To: Jan Kara , linux-kernel@vger.kernel.org (open list) Cc: shuah@kernel.org, david.hunter.linux@gmail.com, Jan Kara , syzbot+3ff7365dc04a6bcafa66@syzkaller.appspotmail.com, syzbot+99bb36d7a3ea562b950e@syzkaller.appspotmail.com, Sukrut Heroorkar Subject: [PATCH 5.15.y 2/2] udf: Verify inode link counts before performing rename Date: Tue, 25 Nov 2025 16:36:37 +0530 Message-ID: <20251125110638.15758-3-hsukrut3@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251125110638.15758-1-hsukrut3@gmail.com> References: <20251125110638.15758-1-hsukrut3@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jan Kara [ Upstream commit 6756af923e06aa33ad8894aaecbf9060953ba00f ] During rename, we are updating link counts of various inodes either when rename deletes target or when moving directory across directories. Verify involved link counts are sane so that we don't trip warnings in VFS. Reported-by: syzbot+3ff7365dc04a6bcafa66@syzkaller.appspotmail.com Signed-off-by: Jan Kara Tested-by: syzbot+99bb36d7a3ea562b950e@syzkaller.appspotmail.com Signed-off-by: Sukrut Heroorkar --- fs/udf/namei.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/fs/udf/namei.c b/fs/udf/namei.c index f4aded54a994..cb98f2d88f40 100644 --- a/fs/udf/namei.c +++ b/fs/udf/namei.c @@ -773,8 +773,18 @@ static int udf_rename(struct user_namespace *mnt_usern= s, struct inode *old_dir, retval =3D -ENOTEMPTY; if (!empty_dir(new_inode)) goto out_oiter; + retval =3D -EFSCORRUPTED; + if (new_inode->i_nlink !=3D 2) + goto out_oiter; } + retval =3D -EFSCORRUPTED; + if (old_dir->i_nlink < 3) + goto out_oiter; is_dir =3D true; + } else if (new_inode) { + retval =3D -EFSCORRUPTED; + if (new_inode->i_nlink < 1) + goto out_oiter; } if (is_dir && old_dir !=3D new_dir) { retval =3D udf_fiiter_find_entry(old_inode, &dotdot_name, --=20 2.43.0