Re: [RFC PATCH] ext4: increase the protection of drop nlink and ext4 inode destroy

From: Theodore Ts'o
Date: Wed Jan 04 2017 - 18:36:02 EST


On Wed, Jan 04, 2017 at 01:54:24PM -0800, Darrick J. Wong wrote:
>
> if (inode->i_nlink == 0) {
> ext4_warning_inode(inode, "nlink is already 0");
> return;
> }

We can't do that because the place where Zhangyi is proposing to
change is in fs/inode.c:drop_nlink(), so we can't add a call to
ext4_error() or ext4_warning().

So how exactly how did we get into this state? When we read the inode
into memory, if i_nlink is zero, we declare the file system as
corrupted immediately.

So I assume this is happening the on-disk i_links_count (which is read
into inode->i_nlink) was too low. So I think the way we should be
handling this is in unlink and rename, before we let i_nlink drop to
zero, we need to check to see if there are other dcache entries
pointing at the inode. If so, we need to call ext4_error(), and in
the errors=continue case, return EFSCORRUPTED (aka EUCLEAN).

- Ted