From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794585409; b=QU2Sibl/dPKKniD4awFKeJBS1DC7LCdtOgWcEVQioqW/KZC3q2FrN2Kd6FObqwovVnoM eIbk/QQDtl1aDD72YgM7pLJDfhkjl8lMiO6HAuhKZgJdwlhbOT54JNnkvetxwcIr79QuO PVH1QPKxh63COYb68Daq81mURFXawcuKXLjZRq+vALq7cPRExzib4zdQDSTnVUbaWuzXm DEuy/rQidMbAaGtMQZkkzxneoAzbJrcKttXYoUasuzZyWrEKBYWTPZCdjsM09VDuFSA8F yFKZfkuugM8O+TjF7+PW0BGi1QJJ41I5IWCj0aCvv0ny1ZqHvoLycvAQv93cm79/QAQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794585409; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=oXqsp1G/91vN+dunGdA15CRl0YnqO9wtx79tXWaWRII=; b=oVUikwVFlDnQ0nvXScZuX0oHKZjZ3pv6et7kHGg4guGy5OfwmEnb7UpkZjLYozDb37Fo 33P74CPs0qfiTp9aa4pZL68lKT0FpWBcW8EaZmeM/9sHfoViNw8H1KAODWlsGNS4LWIOe IMY+ZES0Rq1OwFx1jCf6KFsFQeHbBtYKGKkEtCr6ft+zMt0+vRE5DK7gGDQaRxoYS6vwF C6fyX4U/DjzoHxd9NsBhwexZb+QU6V1xUv1OkSHZl70FED/4vdr0k+yp6QGzRAVraaECp 2t+R1EfVGwcQxzRDQwVOd98T3hPhDMavfvghRADE89dPmMPoxyqznstejlChOa8jJhA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=ApqRXVFh; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C16E5606B2C0; Fri, 13 Nov 2026 15:56:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=ApqRXVFh Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6D53F1F000C7; Fri, 13 Nov 2026 15:56:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794585409; bh=oXqsp1G/91vN+dunGdA15CRl0YnqO9wtx79tXWaWRII=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ApqRXVFhRoQ7mWK8dINoBEtziXkg3FKoXHEWa++eMxVeHaRFl9qb75sLfEDB5IX5n 6ZrdjxGU/ZX5GJXwfjwU1v5wR8kVcNbB8AMSJ56HWE5Ot5BZ68ixJD6FF9L8CBAxGN pCB9CKbkoqUv4iXVUoTJcYh6ARIe6w5dug0rPcsc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yuanfu Xie , Dominique Martinet , Sasha Levin Subject: [PATCH 7.3 077/507] 9p: dont decrement a server-owned zero nlink Date: Fri, 13 Nov 2026 10:46:21 -0500 Message-ID: <20261113153756.192431685@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153753.358973689@linuxfoundation.org> References: <20261113153753.358973689@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yuanfu Xie [ Upstream commit 4e915aa8566173b44146bc46177c85afbe6bdf96 ] A 9P2000.L server can report nlink=0 for a regular file that still exists. On a cache=loose or cache=fscache mount, lookup stores that value with set_nlink(). A later successful unlink calls v9fs_dec_count(), which still calls drop_nlink() for a non-directory. drop_nlink() warns, and the unsigned link count wraps to 4294967295. fstat() on a descriptor opened before the unlink shows 0 before and 4294967295 after. The warning on the unpatched kernel, trimmed: WARNING: fs/inode.c:408 at drop_nlink+0xac/0xd0, CPU#1: trigger/188 CPU: 1 UID: 0 PID: 188 Comm: trigger Tainted: G N 7.3.0-rc4-00537-ga3ff15db6820 #1 PREEMPT(lazy) RIP: 0010:drop_nlink+0xac/0xd0 Call Trace: v9fs_remove+0x529/0x750 vfs_unlink+0x2f0/0xbd0 filename_unlinkat+0x340/0x6c0 __x64_sys_unlink+0x46/0x70 do_syscall_64+0xe8/0x4f0 entry_SYSCALL_64_after_hwframe+0x77/0x7f ---[ end trace 0000000000000000 ]--- Directories whose cached nlink is at most 2 already skip this decrement, because the exported filesystem may not maintain nlink (commit ac89b2ef9b559). cache=none skips it as well (commit 574aa0b479947). cache=mmap does not take this path: it sets neither CACHE_META nor CACHE_LOOSE. A regular file on cache=loose or cache=fscache still does. Its count came from GETATTR and may already be zero, so skip the decrement when i_nlink is already 0. Verified on 7.3-rc4-00537-ga3ff15db6820 with only this change. A server that advertises nlink=0 and accepts the unlink no longer warns, and the open descriptor stays at nlink 0. An honest server on the same mount still goes from 1 to 0. A rejected unlink leaves the count unchanged. cache=none is unchanged. With panic_on_warn the unpatched kernel panics on the warning; the patched kernel does not. Fixes: ac89b2ef9b559 ("9p: don't maintain dir i_nlink if the exported fs doesn't either") Cc: stable@vger.kernel.org Signed-off-by: Yuanfu Xie Message-ID: <8B490036-EBB0-4A36-AE39-F294F7C79649@stu.pku.edu.cn> Signed-off-by: Dominique Martinet Signed-off-by: Sasha Levin --- fs/9p/vfs_inode.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c index 3829554ca3692..2d7e0c1a5353a 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c @@ -495,6 +495,12 @@ static int v9fs_at_to_dotl_flags(int flags) * nothing and races with concurrent metadata fetches that may already * have observed the post-unlink value (nlink == 0). * + * The same applies to a regular file whose cached nlink has already been + * driven to zero by the server: in the cached modes the attributes come + * from GETATTR and are applied verbatim, so decrementing a link count the + * server does not maintain only trips the drop_nlink() WARN_ON and + * underflows i_nlink. + * * @inode: inode whose nlink is being dropped */ static void v9fs_dec_count(struct inode *inode) @@ -503,6 +509,8 @@ static void v9fs_dec_count(struct inode *inode) if (!(v9ses->cache & (CACHE_META | CACHE_LOOSE))) return; + if (inode->i_nlink == 0) + return; if (!S_ISDIR(inode->i_mode) || inode->i_nlink > 2) drop_nlink(inode); } -- 2.53.0