From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 927CD385D72 for ; Wed, 29 Jul 2026 15:06:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785337576; cv=none; b=N8DBUQqjQ5lCVnL9CRpm/IuZcSDDZJ4Y8ZcQY/vRlnFCuLmsAbee4u2sovUYhkbByBDlZ0bNDFwCp0oQ+5WVcl6JOx9T6j6ExdIKPKuVtwFxm9Qe5pUpW4eB5+SEyUdq7vISbgzo4bclwzV1/Es76D7HIVEmrHz0hE6HI/bIKY4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785337576; c=relaxed/simple; bh=P52ys2YS9y/v+yPHb/o3RjWi+cxjHq4guVK7z3nY5TI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=r8gVF3rgYe2FQMvQlRTkgHLGNHdCinOBIYrW0xbdg0KH0qDQGtr8Tee7Zx4xvYN0hWSDVO8RXM79DCEtCJuFNU7PffMSAXHh6dRwfRzsNz+MqyhUZXWY3bZQAzdZpSLp4Wvx8Tzw/HuhAxuppEze877SG2B/8t3YyyPHUSHFJ0E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=S1eeOoIR; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="S1eeOoIR" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2cee9b74ee1so9134515ad.3 for ; Wed, 29 Jul 2026 08:06:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785337574; x=1785942374; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=/0RftUB8JRFAAWmwHlA+R3cASWYLo65vbILw98i4+qE=; b=S1eeOoIRz3W6dYC/2ybWGZlNQs7YX9YKk/Dcyv7o3aA7Np7qWPYgyYE2xYIDJwcwk8 hCN+6qCaLt6obEHNurvoDgQ4bnfLPlreWUMvasWHPBFd1Jt/jmsyU4+mIHJ+xJqvG98j emrbCgZXqCDyPPQe3HVTlFOOKX+X0Rb6r0NWvb29Dx055+VlXH5XhdZKlTGMlcZ+1zGl nfQniGdaCxV7QrANMG2NIs+44ZciRyOBvGPbOV07VDCEdc961aAskP3GRB0eMvdKj81B +pMgsx8PDNi9zDfw4DSuZf7O+mQpODvXpjsYcjHfhkAPHLjjXKd0ABdETDKrWaaCe+c/ pEEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785337574; x=1785942374; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=/0RftUB8JRFAAWmwHlA+R3cASWYLo65vbILw98i4+qE=; b=EeXGlWLc726IuDV5vCyqY7GknKjCgp0HyB6kevyp8Ubu+dGSq03ewIMh7zsM5d9D3c 1OXh8PGqHNFF4Km6k6ZxxqiQm/utFw6llbX0XaZvQQIp28GQk60BMYxc3suqoMQa65N1 K88YuL1NDQ0R4hx1tIoagj2VOyDlNwqc3qneQwG73N12YelpwYGKYF3XorKPPbz60q3g iLx6ekwMO4oW/d7Ot0eon4t83BwYK2g0vh+ZuaZUD/AORHFogQpCkgeYsnlodlukBuiK C0MrME1PF7+Xi9QAsOgy4LEEpYxwndDwOexJBZ9aCPvXVtQK2xXji3Z3wJvoV3qz7J+p 0gDw== X-Forwarded-Encrypted: i=1; AHgh+Rqn0bFWigD25fVCDDlAMDdGGmAia18IYxfi9OUUh1NumwuPJAcxo0GYsUf3tRywKkWaHim/grCw6231y6Y=@vger.kernel.org X-Gm-Message-State: AOJu0YwlZ+z2SwbJIcGCndhDK80QgXCbGmnDlP8Di21eWsoOD9g4p4dX OM6yuM17Uxsa3XLLqonuoQEodDlFAdmHkD8vjF1jmGCMjDGICbpdbcqh X-Gm-Gg: AR+sD13/RZLq2aHv41nGvW6PtzuZbzCZJXqn6zmKJSGH2gAm71pWYelnOB1EPquqUXi GD1h79nlrljbe0j+e2Po1F30wu2cM+G7p+JjDs8TyD8cKSnuGk0q9RmGc0WGx6U7/A4GOG4jNjY asY2RLzqZi4fCNDQ6qRoJ3uSVQSuER2E9RcKmmNtlksUGFe9YEiW5ru7CLHCCoSGGxDlM31M3g5 vorgu6vPwiJtvrBqeMlfBtXzSVaMEhshnKUAem91br/xOE6YKO5dgZvglQ01pmMKn/+Pz4M3+s7 Jun6C2xcG2Wx8Sfi0g9ieo3Ad5wK3nZ1qHNk+lR9MWVxsdUfYwaRD7QW6gkLL4P7rPD2qtiwud3 HAj4qdVm8AFq19gjvAWYqTdgZB7dSUNWv3jYxMvXhR0QxXZV/x1wfEiETiQbVBkRK7cFTpmHxCO C7IZM+LzQgl1H2twyGUuqXQHquOVPW1Ybdnb+LhUhuIHxSp/ActAG+mDb9kQ9hAf5d X-Received: by 2002:a17:902:cf0e:b0:2ca:e5c:7fba with SMTP id d9443c01a7336-2d015daffb7mr79561555ad.39.1785337573485; Wed, 29 Jul 2026 08:06:13 -0700 (PDT) Received: from Default ([2409:40f4:100c:ca91:db1d:88f3:514:9ded]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31504baa01dsm11691702eec.12.2026.07.29.08.06.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 29 Jul 2026 08:06:12 -0700 (PDT) From: Jeffin Philip To: joshua.crofts1@gmail.com Cc: a.hindborg@kernel.org, leitao@debian.org, linux-kernel@vger.kernel.org, syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com, Jeffin Philip Subject: Re: [PATCH] configfs: fix refcount warning in configfs_get_config_item() Date: Wed, 29 Jul 2026 20:35:25 +0530 Message-ID: <20260729150525.100654-1-jeffinphilip14@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260729153102.00003658@gmail.com> References: <20260729153102.00003658@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On Wed, 29 Jul 2026 15:50:00 +0200 Joshua Crofts wrote: >On Wed, 29 Jul 2026 15:21:25 +0530 >Jeffin Philip wrote: > >> On Wed, 29 Jul 2026 09:00 +0000 >> Joshua Crofts wrote: >> >> >On Wed, 29 Jul 2026 08:55:05 +0000 >> >Joshua Crofts wrote: >> > >> >> syzbot reported a "refcount_t: addition on 0; use-after-free" warning >> >> in configfs_get_config_item(). >> >> >> >> This occurs when configfs_get_config_item() races with a concurrent >> >> teardown (e.g. rmdir). When the target config_item's refcount drops to >> >> 0, configfs_get_config_item() calls config_item_get(), which >> >> unconditionally increments the refcount via kref_get(), triggering the >> >> refcount warning. >> >> >> >> Fix this by using config_item_get_unless_zero(), which safely returns >> >> NULL if the refcount is already 0. >> >> Reported-by: syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com >> >> Closes: https://syzkaller.appspot.com/bug?extid=35790eb7861f8fc57382 >> >> Signed-off-by: Joshua Crofts >> >> --- >> >> fs/configfs/configfs_internal.h | 2 +- >> >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> >> >> diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h >> >> index acdeea8e2..5448af3a8 100644 >> >> --- a/fs/configfs/configfs_internal.h >> >> +++ b/fs/configfs/configfs_internal.h >> >> @@ -124,7 +124,7 @@ static inline struct config_item *configfs_get_config_item(struct dentry *dentry >> >> spin_lock(&dentry->d_lock); >> >> if (!d_unhashed(dentry)) { >> >> struct configfs_dirent * sd = dentry->d_fsdata; >> >> - item = config_item_get(sd->s_element); >> >> + item = config_item_get_unless_zero(sd->s_element); >> >> } >> >> spin_unlock(&dentry->d_lock); >> >> I tested this solution first on syzbot and well, it errored out. But on testing it on a local >> build, it seems to trigger a different warning in configfs_get() regarding atomic count. Could you please >> look into it? > >Yeah, I've no idea why syzbot keeps failing on "FATAL: Kernel too old", >especially when testing against upstream. As for the different warning, >that's odd, because when I booted the kernel with the patch in QEMU and >ran the reproducer nothing happened. Could you please send the warning >in it's entirety? I assume you did not set panic_on_warn to 1. Try setting it first and re-run the reproducer. I would also encourage you to copy the .config file from syzbot and build the kernel yourself to test apart from using the prebuilt bzImage. Also as Breno said, this is more of a workaround, you could attempt to drop the dentry immediately after unlinking the group and then attempt to hold an extra reference(?) to the path and then safely free it later. Anyway, here is the warning and call trace: [ 44.009410][ T9943] ------------[ cut here ]------------ [ 44.009414][ T9943] !atomic_read(&sd->s_count) [ 44.009417][ T9943] WARNING: fs/configfs/configfs_internal.h:147 at configfs_symlink+0xe1c/0x1030, CPU#1: refcount/9943 [ 44.009429][ T9943] Modules linked in: [ 44.009437][ T9943] CPU: 1 UID: 0 PID: 9943 Comm: refcount Tainted: G B W 7.2.0-rc4-00365-g48a5a7ab8d6a-dirty #16 PREEMPT_{RT,(full)} [ 44.009445][ T9943] Tainted: [B]=BAD_PAGE, [W]=WARN [ 44.009447][ T9943] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-10.fc44 06/10/2025 [ 44.009450][ T9943] RIP: 0010:configfs_symlink+0xe1c/0x1030 [ 44.009455][ T9943] Code: ba bb 5b ff e9 0b f6 ff ff e8 b0 bb 5b ff 48 c7 c7 e0 54 18 8e e8 24 0f bf 08 e9 f0 f5 ff ff e8 0a c9 bc 08 e8 95 bb 5b ff 90 <0f> 0b 90 e9 8d f8 ff ff e8 87 bb 5b ff 90 0f 0b 90 e9 f [ 44.009460][ T9943] RSP: 0018:ffffc90021e1fc80 EFLAGS: 00010293 [ 44.009465][ T9943] RAX: ffffffff82683b0b RBX: 0000000000000000 RCX: ffff888028f11f40 [ 44.009469][ T9943] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 44.009473][ T9943] RBP: ffffc90021e1fd88 R08: 0000000000000000 R09: 0000000000000000 [ 44.009476][ T9943] R10: dffffc0000000000 R11: ffffed1004074d31 R12: dffffc0000000000 [ 44.009480][ T9943] R13: ffff8880203a6980 R14: ffffffff8bff9748 R15: 1ffff920043c3fa0 [ 44.009484][ T9943] FS: 00007fbc46816780(0000) GS:ffff8881db474000(0000) knlGS:0000000000000000 [ 44.009488][ T9943] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.009492][ T9943] CR2: 0000200000000000 CR3: 000000010e746000 CR4: 0000000000752ef0 [ 44.009498][ T9943] PKRU: 55555554 [ 44.009500][ T9943] Call Trace: [ 44.009502][ T9943] [ 44.009506][ T9943] ? __pfx_configfs_symlink+0x10/0x10 [ 44.009511][ T9943] ? bpf_lsm_inode_symlink+0x9/0x20 [ 44.009518][ T9943] vfs_symlink+0x18b/0x330 [ 44.009523][ T9943] ? security_path_symlink+0xfd/0x360 [ 44.009529][ T9943] filename_symlinkat+0x1cd/0x420 [ 44.009534][ T9943] ? __might_fault+0xcb/0x130 [ 44.009540][ T9943] ? __pfx_filename_symlinkat+0x10/0x10 [ 44.009544][ T9943] ? do_getname+0x151/0x250 [ 44.009549][ T9943] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.009555][ T9943] __se_sys_symlinkat+0x4e/0x2b0 [ 44.009559][ T9943] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.009562][ T9944] Mass Storage Function, version: 2009/09/11 [ 44.009564][ T9943] do_syscall_64+0x174/0x580 [ 44.009569][ T9944] LUN: removable file: (no medium) [ 44.009572][ T9943] ? trace_irq_disable+0x3b/0x140 [ 44.009579][ T9943] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.009583][ T9943] RIP: 0033:0x7fbc46917fa9 [ 44.009588][ T9943] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f 1e 0d 00 f7 d8 8 [ 44.009592][ T9943] RSP: 002b:00007ffcb1d8ec68 EFLAGS: 00000287 ORIG_RAX: 000000000000010a [ 44.009598][ T9943] RAX: ffffffffffffffda RBX: 00007ffcb1d8edc8 RCX: 00007fbc46917fa9 [ 44.009601][ T9943] RDX: 0000200000000300 RSI: 00000000ffffff9c RDI: 0000200000000200 [ 44.009605][ T9943] RBP: 00007ffcb1d8ec70 R08: 00007ffcb1d8eca0 R09: 00007ffcb1d8eca0 [ 44.009616][ T9943] R10: 00007ffcb1d8eca0 R11: 0000000000000287 R12: 0000000000000000 [ 44.009620][ T9943] R13: 00007ffcb1d8edd8 R14: 00007fbc46a38000 R15: 0000000000402e00 [ 44.009625][ T9943] [ 44.009628][ T9943] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 44.009632][ T9943] CPU: 1 UID: 0 PID: 9943 Comm: refcount Tainted: G B W 7.2.0-rc4-00365-g48a5a7ab8d6a-dirty #16 PREEMPT_{RT,(full)} [ 44.009640][ T9943] Tainted: [B]=BAD_PAGE, [W]=WARN [ 44.009642][ T9943] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-10.fc44 06/10/2025 [ 44.009644][ T9943] Call Trace: [ 44.009646][ T9943] [ 44.009648][ T9943] vpanic+0x56c/0xa60 [ 44.009653][ T9943] ? __pfx__printk+0x10/0x10 [ 44.009659][ T9943] ? __pfx_vpanic+0x10/0x10 [ 44.009663][ T9943] ? is_bpf_text_address+0x292/0x2b0 [ 44.009670][ T9943] ? is_bpf_text_address+0x26/0x2b0 [ 44.009678][ T9943] panic+0xc5/0xd0 [ 44.009682][ T9943] ? __pfx_panic+0x10/0x10 [ 44.009688][ T9943] __warn+0x315/0x4c0 [ 44.009692][ T9943] ? configfs_symlink+0xe1c/0x1030 [ 44.009698][ T9943] ? configfs_symlink+0xe1c/0x1030 [ 44.009703][ T9943] __report_bug+0x276/0x570 [ 44.009709][ T9943] ? configfs_symlink+0xe1c/0x1030 [ 44.009715][ T9943] ? __pfx___report_bug+0x10/0x10 [ 44.009722][ T9943] ? configfs_symlink+0xe1c/0x1030 [ 44.009727][ T9943] report_bug+0x16a/0x220 [ 44.009734][ T9943] ? configfs_symlink+0xe1c/0x1030 [ 44.009739][ T9943] ? configfs_symlink+0xe1e/0x1030 [ 44.009743][ T9943] handle_bug+0x9c/0x200 [ 44.009748][ T9943] exc_invalid_op+0x1a/0x50 [ 44.009753][ T9943] asm_exc_invalid_op+0x1a/0x20 [ 44.009757][ T9943] RIP: 0010:configfs_symlink+0xe1c/0x1030 [ 44.009763][ T9943] Code: ba bb 5b ff e9 0b f6 ff ff e8 b0 bb 5b ff 48 c7 c7 e0 54 18 8e e8 24 0f bf 08 e9 f0 f5 ff ff e8 0a c9 bc 08 e8 95 bb 5b ff 90 <0f> 0b 90 e9 8d f8 ff ff e8 87 bb 5b ff 90 0f 0b 90 e9 f [ 44.009767][ T9943] RSP: 0018:ffffc90021e1fc80 EFLAGS: 00010293 [ 44.009771][ T9943] RAX: ffffffff82683b0b RBX: 0000000000000000 RCX: ffff888028f11f40 [ 44.009775][ T9943] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 44.009778][ T9943] RBP: ffffc90021e1fd88 R08: 0000000000000000 R09: 0000000000000000 [ 44.009781][ T9943] R10: dffffc0000000000 R11: ffffed1004074d31 R12: dffffc0000000000 [ 44.009785][ T9943] R13: ffff8880203a6980 R14: ffffffff8bff9748 R15: 1ffff920043c3fa0 [ 44.009790][ T9943] ? configfs_symlink+0xe1b/0x1030 [ 44.009796][ T9943] ? __pfx_configfs_symlink+0x10/0x10 [ 44.009801][ T9943] ? bpf_lsm_inode_symlink+0x9/0x20 [ 44.009807][ T9943] vfs_symlink+0x18b/0x330 [ 44.009811][ T9943] ? security_path_symlink+0xfd/0x360 [ 44.009817][ T9943] filename_symlinkat+0x1cd/0x420 [ 44.009821][ T9943] ? __might_fault+0xcb/0x130 [ 44.009827][ T9943] ? __pfx_filename_symlinkat+0x10/0x10 [ 44.009832][ T9943] ? do_getname+0x151/0x250 [ 44.009836][ T9943] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.009841][ T9943] __se_sys_symlinkat+0x4e/0x2b0 [ 44.009846][ T9943] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.009851][ T9943] do_syscall_64+0x174/0x580 [ 44.009857][ T9943] ? trace_irq_disable+0x3b/0x140 [ 44.009863][ T9943] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.009868][ T9943] RIP: 0033:0x7fbc46917fa9 [ 44.009871][ T9943] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f 1e 0d 00 f7 d8 8 [ 44.009875][ T9943] RSP: 002b:00007ffcb1d8ec68 EFLAGS: 00000287 ORIG_RAX: 000000000000010a [ 44.009880][ T9943] RAX: ffffffffffffffda RBX: 00007ffcb1d8edc8 RCX: 00007fbc46917fa9 [ 44.009884][ T9943] RDX: 0000200000000300 RSI: 00000000ffffff9c RDI: 0000200000000200 [ 44.009888][ T9943] RBP: 00007ffcb1d8ec70 R08: 00007ffcb1d8eca0 R09: 00007ffcb1d8eca0 [ 44.009891][ T9943] R10: 00007ffcb1d8eca0 R11: 0000000000000287 R12: 0000000000000000 [ 44.009895][ T9943] R13: 00007ffcb1d8edd8 R14: 00007fbc46a38000 R15: 0000000000402e00 [ 44.009900][ T9943] [ 44.010148][ T9943] Kernel Offset: disabled Let me know about your approach to fixing this. Thanks, Jeffin.