From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794591060; b=gQ+x43KuMIz/xHo6vQvrpaBgelAvOKbnP76YNs/4wjzxTFqGtiHSnk9pyTzoepALVKcE NPerpTtxQ5Rwf/knT6ljvaPWK3Dh7Bcyyoz+u6b6yegr/umRINV7nL/yrkuvmkJ/HlSKm TT2iQTHqm8PEm0/aOiIHTpccpDEtWcPuWuA2EsEuYaK8TDw677Agf4lBfOeYF38vcgqqN 6EN2AujyJAjm3foL2WhAINWLvhMZW4WWEqwlwLhBMINK01EemGCvGYvqjMCF2QAnEQRbS 9EqVpV7wekVrks+ShxYWiDOIBYsHg5BLfNPfOhZ2U6HS3KinX/6e6YSKhqw+zLLrSfg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794591060; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=vhcmVPsvL7k/LNWS/9cbV2QUcpglWn0aJaeNSgN/atE=; b=lWtzgAiyQ5DQZflP0Z8LTd/tABY7Ahxk0HWRvVDHjwItAzJo5lcAnoBl3DRitdu0MneT /yOm+HylPWA6zfdixuuMyLRpK4vxaKONeVk2w8kVbmOQ9euamwlRjMF9bAwjVL5pIbZd1 5gQ3B3xR6yzLeR3MmFu/vNs+V73KTSo3oFL7Nutj+kMVxxunj2YxVw/1F9GsSBsapMwbD od68Y611M7oDn5Sqvf43/T8O/oHA6q0rRfWDKGibJsKh5q0z8KgrGsTxb0yWUSWMwrlKo CsCRWK+6FAIugVjfFO6I1wbYcd6XC9laSK//9wN8pAPRy2WwImDNW7LqEgsDi3MhqPw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=sMuUIJoG; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 88343606B82D; Fri, 13 Nov 2026 17:31:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=sMuUIJoG Received: by smtp.kernel.org (Postfix) with ESMTPSA id 13B891F000C5; Fri, 13 Nov 2026 17:31:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794591060; bh=vhcmVPsvL7k/LNWS/9cbV2QUcpglWn0aJaeNSgN/atE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=sMuUIJoG3jtN0e6SiVrgtXtUp7zbfnOqW+/dLKgHWZ05rAgkPFIAHxnACOf1vvZxR pwIep/ZWdtNWNYSgYM02uhZc196WFQr7/5WDNDSJrBD/qyvYBMoheXI47kWx4tD4AW 7i2CiMLkQXRC+DPayF7tCLSEsnNEghDLuYJ+40zI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yuanfu Xie , Dominique Martinet , Sasha Levin Subject: [PATCH 6.12 194/670] 9p: dont decrement a server-owned zero nlink Date: Fri, 13 Nov 2026 10:45:58 -0500 Message-ID: <20261113153818.571937707@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153811.177190860@linuxfoundation.org> References: <20261113153811.177190860@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yuanfu Xie [ Upstream commit 4e915aa8566173b44146bc46177c85afbe6bdf96 ] A 9P2000.L server can report nlink=0 for a regular file that still exists. On a cache=loose or cache=fscache mount, lookup stores that value with set_nlink(). A later successful unlink calls v9fs_dec_count(), which still calls drop_nlink() for a non-directory. drop_nlink() warns, and the unsigned link count wraps to 4294967295. fstat() on a descriptor opened before the unlink shows 0 before and 4294967295 after. The warning on the unpatched kernel, trimmed: WARNING: fs/inode.c:408 at drop_nlink+0xac/0xd0, CPU#1: trigger/188 CPU: 1 UID: 0 PID: 188 Comm: trigger Tainted: G N 7.3.0-rc4-00537-ga3ff15db6820 #1 PREEMPT(lazy) RIP: 0010:drop_nlink+0xac/0xd0 Call Trace: v9fs_remove+0x529/0x750 vfs_unlink+0x2f0/0xbd0 filename_unlinkat+0x340/0x6c0 __x64_sys_unlink+0x46/0x70 do_syscall_64+0xe8/0x4f0 entry_SYSCALL_64_after_hwframe+0x77/0x7f ---[ end trace 0000000000000000 ]--- Directories whose cached nlink is at most 2 already skip this decrement, because the exported filesystem may not maintain nlink (commit ac89b2ef9b559). cache=none skips it as well (commit 574aa0b479947). cache=mmap does not take this path: it sets neither CACHE_META nor CACHE_LOOSE. A regular file on cache=loose or cache=fscache still does. Its count came from GETATTR and may already be zero, so skip the decrement when i_nlink is already 0. Verified on 7.3-rc4-00537-ga3ff15db6820 with only this change. A server that advertises nlink=0 and accepts the unlink no longer warns, and the open descriptor stays at nlink 0. An honest server on the same mount still goes from 1 to 0. A rejected unlink leaves the count unchanged. cache=none is unchanged. With panic_on_warn the unpatched kernel panics on the warning; the patched kernel does not. Fixes: ac89b2ef9b559 ("9p: don't maintain dir i_nlink if the exported fs doesn't either") Cc: stable@vger.kernel.org Signed-off-by: Yuanfu Xie Message-ID: <8B490036-EBB0-4A36-AE39-F294F7C79649@stu.pku.edu.cn> Signed-off-by: Dominique Martinet Signed-off-by: Sasha Levin --- fs/9p/vfs_inode.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c index 90fe3ea09595d..7cb3f4b89dcc3 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c @@ -493,6 +493,12 @@ static int v9fs_at_to_dotl_flags(int flags) * nothing and races with concurrent metadata fetches that may already * have observed the post-unlink value (nlink == 0). * + * The same applies to a regular file whose cached nlink has already been + * driven to zero by the server: in the cached modes the attributes come + * from GETATTR and are applied verbatim, so decrementing a link count the + * server does not maintain only trips the drop_nlink() WARN_ON and + * underflows i_nlink. + * * @inode: inode whose nlink is being dropped */ static void v9fs_dec_count(struct inode *inode) @@ -501,6 +507,8 @@ static void v9fs_dec_count(struct inode *inode) if (!(v9ses->cache & (CACHE_META | CACHE_LOOSE))) return; + if (inode->i_nlink == 0) + return; if (!S_ISDIR(inode->i_mode) || inode->i_nlink > 2) drop_nlink(inode); } -- 2.53.0