From: Ziyi Guo <n7l8m4@u.northwestern.edu>
Date: Wed, 11 Feb 2026 02:20:52 +0000 (+0000)
Subject: ext2: avoid drop_nlink() during unlink of zero-nlink inode in ext2_unlink()
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=19134a133184fcc49c41cf42797cb2e7fef76065;p=thirdparty%2Fkernel%2Fstable.git

ext2: avoid drop_nlink() during unlink of zero-nlink inode in ext2_unlink()

ext2_unlink() calls inode_dec_link_count() unconditionally, which
invokes drop_nlink(). If the inode was loaded from a corrupted disk
image with i_links_count == 0, drop_nlink()
triggers WARN_ON(inode->i_nlink == 0)

Follow the ext4 pattern from __ext4_unlink(): check i_nlink before
decrementing. If already zero, skip the decrement.

Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Link: https://patch.msgid.link/20260211022052.973114-1-n7l8m4@u.northwestern.edu
Signed-off-by: Jan Kara <jack@suse.cz>
---

diff --git a/fs/ext2/namei.c b/fs/ext2/namei.c
index 3ab23de558fb..0d09d22fe708 100644
--- a/fs/ext2/namei.c
+++ b/fs/ext2/namei.c
@@ -291,7 +291,10 @@ static int ext2_unlink(struct inode *dir, struct dentry *dentry)
 		goto out;
 
 	inode_set_ctime_to_ts(inode, inode_get_ctime(dir));
-	inode_dec_link_count(inode);
+
+	if (inode->i_nlink)
+		inode_dec_link_count(inode);
+
 	err = 0;
 out:
 	return err;