On 10/27/25 21:06, Deepanshu Kartikey wrote:
> F2FS can mount filesystems with corrupted directory depth values that
> get runtime-clamped to MAX_DIR_HASH_DEPTH. When RENAME_WHITEOUT
> operations are performed on such directories, f2fs_rename performs
> directory modifications (updating target entry and deleting source
> entry) before attempting to add the whiteout entry via f2fs_add_link.
>
> If f2fs_add_link fails due to the corrupted directory structure, the
> function returns an error to VFS, but the partial directory
> modifications have already been committed to disk. VFS assumes the
> entire rename operation failed and does not update the dentry cache,
> leaving stale mappings.
>
> In the error path, VFS does not call d_move() to update the dentry
> cache. This results in new_dentry still pointing to the old inode
> (new_inode) which has already had its i_nlink decremented to zero.
> The stale cache causes subsequent operations to incorrectly reference
> the freed inode.
>
> This causes subsequent operations to use cached dentry information that
> no longer matches the on-disk state. When a second rename targets the
> same entry, VFS attempts to decrement i_nlink on the stale inode, which
> may already have i_nlink=0, triggering a WARNING in drop_nlink().
>
> Example sequence:
> 1. First rename (RENAME_WHITEOUT): file2 → file1
> - f2fs updates file1 entry on disk (points to inode 8)
> - f2fs deletes file2 entry on disk
> - f2fs_add_link(whiteout) fails (corrupted directory)
> - Returns error to VFS
> - VFS does not call d_move() due to error
> - VFS cache still has: file1 → inode 7 (stale!)
> - inode 7 has i_nlink=0 (already decremented)
>
> 2. Second rename: file3 → file1
> - VFS uses stale cache: file1 → inode 7
> - Tries to drop_nlink on inode 7 (i_nlink already 0)
> - WARNING in drop_nlink()
>
> Fix this by explicitly invalidating old_dentry and new_dentry when
> f2fs_add_link fails during whiteout creation. This forces VFS to
> refresh from disk on subsequent operations, ensuring cache consistency
> even when the rename partially succeeds.
>
> Reproducer:
> 1. Mount F2FS image with corrupted i_current_depth
> 2. renameat2(file2, file1, RENAME_WHITEOUT)
> 3. renameat2(file3, file1, 0)
> 4. System triggers WARNING in drop_nlink()
>
> Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT")
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=632cf32276a9a564188d
> Suggested-by: Chao Yu <[email protected]>
> Link:
> https://lore.kernel.org/all/[email protected]/
> [v1]
> Cc: [email protected]
> Signed-off-by: Deepanshu Kartikey <[email protected]>
Reviewed-by: Chao Yu <[email protected]>
Thanks,
_______________________________________________
Linux-f2fs-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
