Always check for usage underflow when removing a file in storage.c

Part of #22424.

diff --git a/src/common/storagedir.c b/src/common/storagedir.c
index 6457f3d0091ba0f64aa4cd9609e01d09b30d5579..9140ed29bdef517f739e1b166f6a87fc7bf8c8d5 100644 (file)
--- a/src/common/storagedir.c
+++ b/src/common/storagedir.c
@@ -425,7 +425,9 @@ storage_dir_remove_file(storage_dir_t *d,
     }
   }
   if (unlink(ipath) == 0) {
-    d->usage -= size;
+    if (! BUG(d->usage < size)) {
+      d->usage -= size;
+    }
   } else {
     log_warn(LD_FS, "Unable to unlink %s", escaped(path));
     tor_free(path);