fs/ntfs3: cancle set bad inode after removing name fails
[ Upstream commit d99208b9 ] The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted. The underlying bug is that make_bad_inode() is called on a live inode. In some cases it's "icache lookup finds a normal inode, d_splice_alias() is called to attach it to dentry, while another thread decides to call make_bad_inode() on it - that would evict it from icache, but we'd already found it there earlier". In some it's outright "we have an inode attached to dentry - that's how we got it in the first place; let's call make_bad_inode() on it just for shits and giggles". Fixes: 78ab59fe ("fs/ntfs3: Rework file operations") Reported-by:<syzbot+1aa90f0eb1fc3e77d969@syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=1aa90f0eb1fc3e77d969 Signed-off-by:
Edward Adam Davis <eadavis@qq.com> Signed-off-by:
Konstantin Komarov <almaz.alexandrovich@paragon-software.com> Signed-off-by:
Sasha Levin <sashal@kernel.org>
Loading