Re: [PATCH] nilfs2: handle corrupted checkpoint count gracefully during deletion

On Tue, 2026-07-07 at 16:59 +0900, Ryusuke Konishi wrote:
> From: Igor Putko <[email protected]>
>=20
> Syzkaller reported a kernel warning in
> nilfs_cpfile_delete_checkpoints()
> due to a corrupted checkpoint count on the storage medium where
> le32_to_cpu(cp->cp_checkpoints_count) is less than the number of
> checkpoints being deleted.
> Triggering a WARN_ON() for disk image corruption is suboptimal. Fix
> this by returning -EIO and reporting a filesystem error via
> nilfs_error() instead of interrupting execution with a kernel
> warning.
>=20
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=3D79b815da3aec0a6a4d02
> Signed-off-by: Igor Putko <[email protected]>
> Fixes: 1f5abe7e7dbc ("nilfs2: replace BUG_ON and BUG calls
> triggerable from ioctl")
> Cc: <[email protected]> # Warning suppression primarily;
> will request backport individually if needed
> Signed-off-by: Ryusuke Konishi <[email protected]>
> ---
> Hi Viacheslav,
>=20
> Please apply this for the next cycle.
>=20
> This fixes a kernel warning and a missed inconsistency check that
> could
> occur with file system images containing corrupted checkpoint
> metadata.
>=20
> Thanks,
> Ryusuke Konishi
>=20
> =C2=A0fs/nilfs2/cpfile.c | 20 ++++++++++++++++----
> =C2=A01 file changed, 16 insertions(+), 4 deletions(-)
>=20
> diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
> index 4bbdc832d7f2..d3349fa58abe 100644
> --- a/fs/nilfs2/cpfile.c
> +++ b/fs/nilfs2/cpfile.c
> @@ -81,18 +81,26 @@ nilfs_cpfile_block_add_valid_checkpoints(const
> struct inode *cpfile,
> =C2=A0	return count;
> =C2=A0}
> =C2=A0
> -static unsigned int
> +static int
> =C2=A0nilfs_cpfile_block_sub_valid_checkpoints(const struct inode *cpfile=
,
> =C2=A0					 struct buffer_head *bh,
> =C2=A0					 unsigned int n)
> =C2=A0{
> =C2=A0	struct nilfs_checkpoint *cp;
> -	unsigned int count;
> +	unsigned int checkpoints_count;
> +	int count;
> =C2=A0
> =C2=A0	cp =3D kmap_local_folio(bh->b_folio,
> =C2=A0			=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 offset_in_folio(bh->b_folio, bh-
> >b_data));
> -	WARN_ON(le32_to_cpu(cp->cp_checkpoints_count) < n);
> -	count =3D le32_to_cpu(cp->cp_checkpoints_count) - n;
> +	checkpoints_count =3D le32_to_cpu(cp->cp_checkpoints_count);
> +	if (unlikely(checkpoints_count < n)) {
> +		nilfs_error(cpfile->i_sb,
> +			=C2=A0=C2=A0=C2=A0 "deleted checkpoints count %u exceeds
> block count %u",
> +			=C2=A0=C2=A0=C2=A0 n, checkpoints_count);
> +		kunmap_local(cp);
> +		return -EIO;
> +	}
> +	count =3D checkpoints_count - n;
> =C2=A0	cp->cp_checkpoints_count =3D cpu_to_le32(count);
> =C2=A0	kunmap_local(cp);
> =C2=A0	return count;
> @@ -522,6 +530,10 @@ int nilfs_cpfile_delete_checkpoints(struct inode
> *cpfile,
> =C2=A0		count =3D
> nilfs_cpfile_block_sub_valid_checkpoints(cpfile, cp_bh,
> =C2=A0							=09
> nicps);
> =C2=A0		brelse(cp_bh);
> +		if (unlikely(count < 0)) {
> +			ret =3D count;
> +			break;
> +		}
> =C2=A0		if (count)
> =C2=A0			continue;
> =C2=A0

Applied.

Thanks,
Slava.