hammer2_vop_nlink increments meta.nlinks even when hammer2_dirent_create fails — permanent link-count inflation and unfreeable inodes

Summary

In hammer2_vop_nlink the nlinks increment is executed unconditionally after hammer2_dirent_create(): error = hammer2_dirent_create(...); hammer2_inode_modify(ip); ++ip->meta.nlinks; ip->meta.ctime = cmtime; — even when dirent_create returned an error (ENOSPC from backend allocation or collision exhaustion, EIO from backend xop failure). Every failing link(2) permanently inflates the persistent link count by 1, so a file whose real links are later removed never reaches nlinks==0 and its inode plus all data blocks can never be freed. The sibling ops (ncreate/nmkdir/nmknod) correctly dispose on dirent_create failure via hammer2_inode_unlink_finisher, proving the intent.

Root cause

vnops.c:1599-1606: the if (error == 0) guard at :1604 only protects the tdip mtime update and namecache finalization; the inode mutation at :1601-1603 runs regardless. hammer2_dirent_create fails with ENOSPC when the mkdirent backend xop hits HAMMER2_ERROR_ENOSPC (full filesystem) or when the lhc collision space is exhausted (hammer2_inode.c:1324-1326), and with EIO on backend errors — all persisted by the unconditional hammer2_inode_modify(ip) at :1601. Since vop_nlink only pre-checks enospc > 1 (:1563), a full-but-not-red filesystem still reaches the failing create. hammer2_inode_unlink_finisher (hammer2_inode.c:1623-1628) only zeroes nlinks when <= 1, so the inflated count blocks reclamation.

Threat model & preconditions

• Attacker position: unprivileged local user on a writable hammer2 filesystem.
• Privileges gained or impact: fill the PFS to capacity, then loop link("existing","newname") — each fails (ENOSPC) but increments the target's persistent nlinks; afterwards the file cannot be fully unlinked: permanent disk-space leak and nlink mismatch. Multi-user systems can weaponize it to leak space attributed to other users' files.
• Required config or capabilities: write permission on the directory.
• Reachability: link(2) on a full/collision-exhausted PFS.

Proof of concept

Build & run

fill /h2 with junk until write() returns ENOSPC; then
for (i=0;i<1000;i++) link("/h2/victim", "/h2/l%d", i);  /* each -1 ENOSPC */
stat("/h2/victim").st_nlink   /* now 1001 with no new entries */

Expected output

st_nlink inflated by the number of failed links; after rm of all real names
st_nlink stays > 0 and the inode/blocks stay allocated (freemap occupancy
before/after).

Impact

Persistent metadata integrity corruption + unbounded on-disk space leak; no memory-safety impact.

Recommended fix

Only account the link when the dirent was actually created:

--- a/sys/vfs/hammer2/hammer2_vnops.c
+++ b/sys/vfs/hammer2/hammer2_vnops.c
@@ -1599,11 +1599,12 @@ hammer2_vop_nlink(struct vop_nlink_args *ap)
    error = hammer2_dirent_create(tdip, name, name_len,
                      ip->meta.inum, ip->meta.type);
-   hammer2_inode_modify(ip);
-   ++ip->meta.nlinks;
-   ip->meta.ctime = cmtime;
    if (error == 0) {
+       hammer2_inode_modify(ip);
+       ++ip->meta.nlinks;
+       ip->meta.ctime = cmtime;
        /*
         * Update dip's [cm]time
         */

Timeline

• 2026-08-28 Discovered during automated audit (pass 2, GLM 5.3).