From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lj1-f179.google.com (mail-lj1-f179.google.com [209.85.208.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 50BEB3A48F6 for ; Mon, 6 Jul 2026 11:08:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783336094; cv=none; b=pNBw5uUlX0zRPw0BY+mUAjh5lTTXGwuOyxJ+RH4BWD3ME6plosSxNi0dPDLjAVMBMDyEwfaSNgb9eeuQduFLq/awsibcTJjn0HxidG4gOfO2ml0FvCnHSsHMq+qWwokxMby8TmK9DI11XZnmYw9SUriQ6//K+CuF3szkAo+0JKU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783336094; c=relaxed/simple; bh=vpa89zqJRQ9fSGMVcwJznhT3rLkKb/H+YNZTERWaYC8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=aO+upP4MEjDw4s3ZZQWtFkzPls7AjwtF+yj51VBuJpVAjEtJPD2uy+XiULDg/BQG6OgxXzUIBNBA2hJH2h3B2ZyMH66YHDRsDtUoibQgYyzTDs3FM6TVFEwEAvKM4Rxik36/41QS15QmnDMaT6YpUTFwCO/f5o1W4PVKvXT/QPU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=e5aXNFTH; arc=none smtp.client-ip=209.85.208.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="e5aXNFTH" Received: by mail-lj1-f179.google.com with SMTP id 38308e7fff4ca-39b03d41976so23685861fa.3 for ; Mon, 06 Jul 2026 04:08:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783336091; x=1783940891; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=vtUwtg812qYxWb4tbGZyGStRjOL012fzxVYjSpjnYjQ=; b=e5aXNFTHoYy/h7j3C84HNhaebC2kit362uddQx0aMgMll3mXztldwl8deoRDXnx+wC u/gzODpeV1+QXXzokEiFjDs7JdJSymYbzqzsSV2Wk2qm+VNAgsVKjN3Ifd7tvolLHyN+ Mu5iU6HEf8Kt0S2F4TmEPU7XAthnKZnpPXGz/aPkELLxpPXLHqLGwA0Mp9og+UWg6lat OpicZ9NJolZYCUSwMnFGnH3E+ghyL4Clum/fRnpS6GCVz8QSKkIEHN/N51ZOAtj51rGK jDqpis91qD8k+lW4OVJpxVT7o/ZYU6Us6G6xmsRdYTSyxPdqZ1d/kd1LFnqffRbaiBKv Xauw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783336091; x=1783940891; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=vtUwtg812qYxWb4tbGZyGStRjOL012fzxVYjSpjnYjQ=; b=XzhPtb28bsGoC2NFt2i+zfX4E1iybpG3WrXzJL50Ry478rZJYn0HSt2cThmppGx70I by4Y5tUgFpBXxqHEApuL+N2Nnx4OxATVueJtnKPFxDmkjen+6Y9rn9I4dA51X0W1UFd6 siWjLzjqCWGeRJH6BuDQRDmur6UyBU3xDW9kjSPVn9FAWwPaoK1guCrflBTNZxeCYoP8 ArKgi+63I5jdjzU8IIQ2Wp97lDacaBBsQt1gDcy9iKISqyUfYW/PK5geT1JS0/qWlmJW O/RcKjYg/APIKcS2MSuIt4RJXxhvsgwJISiKBn7suXcCXI6FpdqwtAC9295HDzkSalxa Xd8g== X-Forwarded-Encrypted: i=1; AHgh+RrVwkM8SefOTKe1xXUt4bT1lM/E5UH0CQx14++3uhqBkbbE9zL7gH09adPmszy8MLcPDzGgnToSNk+mlqw=@vger.kernel.org X-Gm-Message-State: AOJu0YxNHStCtYXel4iJCdUSSNKgcAYdyvCA46QVulMfgTnF4EBejXmv F2YN+pB5fALkR29v+ezbaluP0X8uraxFmySiFbi+mePv3Lu9hYmk44Em64dxptjRFkQ= X-Gm-Gg: AfdE7cm7wVac3FatinSDui495k0PPEMRF5E3Ogd+KmjY1jna8KD5JrkdQoeBcAxgohd NOoaMh6X8JcLHn9PXhnW8thnB63J0UyJD0kiRjwJM5QojkcM+VE/yHxdDSpdECNTuJNKzxsPQN5 sLekLszArcUhG2yO7pPuFMgmaSooN+FxNqHKhazOOMgX+c+hZ2g/iUTaOBVnWfvmO7LYHbyyWZZ jpNpDdXjMmbBmWRckcVt7lFP2ERkimvvSkHpN/jMoldulkc2veZYdjEYSCy2RoaYQCUVYQZupPb ylu1fj8T2q8ksLEqW62fMVTXtC8QoPIAuFCJ5sfK2/2dmxV8pVNmkqgA/FHu4vLsi+aYfMMPE8L WrrZA/f80FUMUnA+TYj7H8OqtdUZje1T28O8lvo41CzSZEP2LzkMaJCtOv/XN+L+nM24i6J1/rI 4tJ3wh+MvZiNjJeGgjUxBXXDSuNWV0mgHKYRY7L/lGEUHL5I0+j6vfaqjSdoOnmx6kJyynH4X2y K680Gg= X-Received: by 2002:a05:6512:620d:b0:5ae:b880:d4a8 with SMTP id 2adb3069b0e04-5aed50b6680mr1649603e87.57.1783336091255; Mon, 06 Jul 2026 04:08:11 -0700 (PDT) Received: from debian.localdomain (95-25-158-125.broadband.corbina.ru. [95.25.158.125]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5aed13bfd1fsm2706666e87.55.2026.07.06.04.08.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2026 04:08:10 -0700 (PDT) From: Igor Putko To: konishi.ryusuke@gmail.com, slava@dubeyko.com Cc: linux-nilfs@vger.kernel.org, linux-kernel@vger.kernel.org, Igor Putko , syzbot+79b815da3aec0a6a4d02@syzkaller.appspotmail.com Subject: [PATCH] nilfs2: handle corrupted checkpoint count gracefully during deletion Date: Mon, 6 Jul 2026 14:08:07 +0300 Message-ID: <20260706110807.2835-1-igorpetindev@gmail.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Syzkaller reported a kernel warning in nilfs_cpfile_delete_checkpoints() due to a corrupted checkpoint count on the storage medium where le32_to_cpu(cp->cp_checkpoints_count) is less than the number of checkpoints being deleted. Triggering a WARN_ON() for disk image corruption is suboptimal. Fix this by returning -EIO and reporting a filesystem error via nilfs_error() instead of interrupting execution with a kernel warning. Reported-by: syzbot+79b815da3aec0a6a4d02@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=79b815da3aec0a6a4d02 Signed-off-by: Igor Putko --- fs/nilfs2/cpfile.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c index 4bbdc832d..d3349fa58 100644 --- a/fs/nilfs2/cpfile.c +++ b/fs/nilfs2/cpfile.c @@ -81,18 +81,26 @@ nilfs_cpfile_block_add_valid_checkpoints(const struct inode *cpfile, return count; } -static unsigned int +static int nilfs_cpfile_block_sub_valid_checkpoints(const struct inode *cpfile, struct buffer_head *bh, unsigned int n) { struct nilfs_checkpoint *cp; - unsigned int count; + unsigned int checkpoints_count; + int count; cp = kmap_local_folio(bh->b_folio, offset_in_folio(bh->b_folio, bh->b_data)); - WARN_ON(le32_to_cpu(cp->cp_checkpoints_count) < n); - count = le32_to_cpu(cp->cp_checkpoints_count) - n; + checkpoints_count = le32_to_cpu(cp->cp_checkpoints_count); + if (unlikely(checkpoints_count < n)) { + nilfs_error(cpfile->i_sb, + "deleted checkpoints count %u exceeds block count %u", + n, checkpoints_count); + kunmap_local(cp); + return -EIO; + } + count = checkpoints_count - n; cp->cp_checkpoints_count = cpu_to_le32(count); kunmap_local(cp); return count; @@ -522,6 +530,10 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile, count = nilfs_cpfile_block_sub_valid_checkpoints(cpfile, cp_bh, nicps); brelse(cp_bh); + if (unlikely(count < 0)) { + ret = count; + break; + } if (count) continue; -- 2.47.3