From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 22B22386C1C for ; Thu, 30 Jul 2026 07:30:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785396629; cv=none; b=HzERun4xZDiW2TeOWhIkNoXURkkoqW4rRARxpKNbzt6juXnEwRZ8tartgxONoWwuq5T+D/5/OkkQ53TY0pQTLTXDEvMZkh6zIvMVSqw9M/0i9c/4FAr+4gqzBBuOj7lzQK/e8FV3SvAriFZDFjJNRCN6H2TtJVlaK5VtrHaI8jM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785396629; c=relaxed/simple; bh=PsI80sK8ArgMP40WBlv5SX+K4xYWdw5jH2DCKprxjV8=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=boNQyNl6ha8xtsY0jyXTLXmnZzpcXC6uFyEyWixWGll8+nWepvG7fnzAZZWu1N207721W/h2JOhy3vJzVzZ4Qkjv8x3GSlxJkVoNcQG3GhA4zNjH2V1X2zAQTPu/OD73l9fkLjdoubcXDXatCVUsbqA0/CiuFgN2ma4mUjaifQg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=D826KRA/; arc=none smtp.client-ip=209.85.128.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="D826KRA/" Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4955aa106b1so16435235e9.0 for ; Thu, 30 Jul 2026 00:30:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785396623; x=1786001423; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=bZBgeMdxn+o5Z80aCBwdyp0fELfbTLb7Za6sGejcjJ0=; b=D826KRA/8n76qab4lJ/6mAYNWqeeIzP4npsFRMTzwxny8cTKWJjx4YhmbCfgHnz5oq uo57Fl+IrQ3Mz5u39hgIn3NkapsEK0SaTurRzFy1ZCCE1CLGLDvQYijF0kRo9vULTdz1 gvYZ5lABlTuHffgMmUSO4mBvYzXP3sBmQLlZJ9a2kS4JkP3GI2kh35uWp9eO91Obg/Y+ TtG7swCpmRgqnZbMOaHyfaiAgl6LAXiOUFp5Mgp7Nr7qx4iM6hvblrq7+/V4Uow9uHli M2/p0nQ2sM7eKhbrVuKlyY0PTcslCkHDtMfFcmsR31ys6QLXcdBbLjRtQf+HIovgn+C/ REHw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785396623; x=1786001423; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=bZBgeMdxn+o5Z80aCBwdyp0fELfbTLb7Za6sGejcjJ0=; b=GjPmuospE88v0iRvRlzINdV3z/HpaxO3cmaYuiIg7SbuDj2JwdnoTFUHKAULoPTeAO L7zgLnBNoYHFe1DtY96zrS6DJashjF2wTNYIAlc7eVz00ilCj8CQXe7XwUbor2hYxoEK zax7p3BPx9s137JD3V0ri3WOBvX0p8Uzl/HMK9VWf4KekWP817uK2njuru2PI4M2UB0M uk353ZB1yOswY2nDel1HqMthImJAOOgz9GDRScvqb+sEztrxZDu38UhwG3un4hJUMxUv hS0UAL+9BqjxzpNgYQexIBlJREC1Zgf2enwbBFUA3eZnoudbi2SaVXOj5RtpVq7GS43Y 2/hQ== X-Forwarded-Encrypted: i=1; AHgh+RrTrEorMflR4TEBKy3x7ou1mr1lumS8PncqV7nWq4YuIKcOZojQ3K6oROKSzZwg8EuerP6zYfBsJrtp9yY=@vger.kernel.org X-Gm-Message-State: AOJu0YxD0jSAMDXvD6Q05EW/x6KH1SRledIC6qltpXo2Pfh0lNq39d4V spl6xakcenPlRI23KeI5JeSJGz32gqdvS9Bi2yM2WvqTzpTq/fegNkhQiVnCpgvxlSA= X-Gm-Gg: AR+sD11BpuFtpQzf3EeaNoJIAp/brZXvMmJeVMkK8l0VNzLD9b+925rNtnJb8FUEuUu 1VYG2dg+peCZXEOTdB75YArqKn9Qvjp+LK+uYQTgQ2srYQkAWRm1AeBhvEvM2Dekqle3dugsvf4 /zXDJqqV6oUTCXPAd7PPzArJqMGtQCLK7FT07LNw1lA7aHwwN5HpUyury4AOWlK57WQ41jhhOt+ rFE+uOWwHXdcQYFHnj9UTFCV/19DGTjVbl5y76EP82Un/J6cAPfdZloYGlzPG2mggWFUWUGEfzP h6EiPsXddWrQZEAkbz6e/tyNngb3M+eNLyLwLshGxVvjaTyzty6g6r3yWcpLmjDh0gip9Y3COOI vGHe0+rRgbqCvulFq1k3tIvzajpQEFtqi4dVt59iAYSpzcHzSqywbak4L5NXdjds42qZ2a8YN8N mbchjuEpeLzBKy0fPtSlF/4fEN0pmkl/UjwTxXHX5ExyYsUqXnrYNmjsUlUry3SgOCbaAD/FG1S m6OBi+4akCAvkk8QpFau0FfPpStn+/NUaxVVJX+ocpLTY9LvSaMhjqDVe7FwkJsGhrby8yorUDt ORa1JkL8/tTgrVZSeuOwxTvKjKnRMpl5cX0fIElmDMHFFVG/53NPGGJCXU64U2yH3t/hgEpp6KX XNZw3r1uootPJRnACjIELJFBDqQO8M2KgoRuc0o66JlwrLcmz/onxsJThuKJ9bZNanOhxc0c= X-Received: by 2002:a05:600c:3115:b0:496:c1f3:e8f8 with SMTP id 5b1f17b1804b1-49800e6e82bmr16997905e9.7.1785396622670; Thu, 30 Jul 2026 00:30:22 -0700 (PDT) Received: from localhost (90-182-112-124.rcp.o2.cz. [90.182.112.124]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47fc88e3c73sm3990671f8f.10.2026.07.30.00.30.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Jul 2026 00:30:22 -0700 (PDT) Date: Thu, 30 Jul 2026 09:30:15 +0200 From: Joshua Crofts To: Jeffin Philip Cc: a.hindborg@kernel.org, leitao@debian.org, linux-kernel@vger.kernel.org, syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com Subject: Re: [PATCH] configfs: fix refcount warning in configfs_get_config_item() Message-ID: <20260730093015.000026cd@gmail.com> In-Reply-To: <20260729150525.100654-1-jeffinphilip14@gmail.com> References: <20260729153102.00003658@gmail.com> <20260729150525.100654-1-jeffinphilip14@gmail.com> X-Mailer: Claws Mail 4.4.0 (GTK 3.24.51; x86_64-w64-mingw32) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Wed, 29 Jul 2026 20:35:25 +0530 Jeffin Philip wrote: > >> I tested this solution first on syzbot and well, it errored out. But on testing it on a local > >> build, it seems to trigger a different warning in configfs_get() regarding atomic count. Could you please > >> look into it? > > > >Yeah, I've no idea why syzbot keeps failing on "FATAL: Kernel too old", > >especially when testing against upstream. As for the different warning, > >that's odd, because when I booted the kernel with the patch in QEMU and > >ran the reproducer nothing happened. Could you please send the warning > >in it's entirety? > > I assume you did not set panic_on_warn to 1. Try setting it first and > re-run the reproducer. I would also encourage you to copy the .config file > from syzbot and build the kernel yourself to test apart from using the > prebuilt bzImage. Also as Breno said, this is more of a workaround, you > could attempt to drop the dentry immediately after unlinking the group and > then attempt to hold an extra reference(?) to the path and then safely free > it later. > Yes, the kernel was build with the .config from syzbot but my script had panic_on_warn set to zero. Anyhow - ran the reproducer and got a slab-use-after-free instead :( [ 42.758574][ T5767] BUG: KASAN: slab-use-after-free in configfs_dirent_is_ready+0x6b/0x70 [ 42.758655][ T5767] Read of size 4 at addr ffff88804b241fb8 b[ 42.758655][ T5767] Read of size 4 at addr ffff88804b241fb8 by task repro/5767 [ 42.758661][ T5767] [ 42.758695][ T5767] CPU: 0 UID: 0 PID: 5767 Comm: repro Not tainted 7.2.0-rc3-g6291aad4984e #8 PREEMPT_{RT,(full)} [ 42.758705][ T5767] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 42.758710][ T5767] Call Trace: [ 42.758714][ T5767] [ 42.758717][ T5767] dump_stack_lvl+0x100/0x190 [ 42.758727][ T5767] print_report+0x13d/0x4b0 [ 42.758738][ T5767] ? __virt_addr_valid+0x239/0x430 [ 42.758748][ T5767] ? configfs_dirent_is_ready+0x6b/0x70 [ 42.758755][ T5767] kasan_report+0xdf/0x1c0 [ 42.758765][ T5767] ? configfs_dirent_is_ready+0x6b/0x70 [ 42.758773][ T5767] configfs_dirent_is_ready+0x6b/0x70 [ 42.758832][ T5767] configfs_symlink+0x5c4/0x11f0 [ 42.758840][ T5767] ? bpf_lsm_inode_permission+0x9/0x10 [ 42.758849][ T5767] ? security_inode_permission+0xbf/0x250 [ 42.758857][ T5767] ? __pfx_configfs_symlink+0x10/0x10 [ 42.758866][ T5767] vfs_symlink+0x178/0x4e0 [ 42.758875][ T5767] filename_symlinkat+0x2a6/0x570 [ 42.758888][ T5767] ? __pfx_filename_symlinkat+0x10/0x10 [ 42.758901][ T5767] ? strncpy_from_user+0x19d/0x2d0 [ 42.758911][ T5767] ? do_getname+0x191/0x390 [ 42.758918][ T5767] __x64_sys_symlinkat+0x9c/0xe0 [ 42.758931][ T5767] do_syscall_64+0x115/0x840 [ 42.758958][ T5767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 42.758967][ T5767] RIP: 0033:0x416df9 [ 42.758973][ T5767] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 f0 ff ff ff f7 d8 64 89 01 48 [ 42.759021][ T5767] RSP: 002b:00007ffe2756add8 EFLAGS: 00000287 ORIG_RAX: 000000000000010a [ 42.759030][ T5767] RAX: ffffffffffffffda RBX: 00007ffe2756af48 RCX: 0000000000416df9 [ 42.759035][ T5767] RDX: 0000200000000300 RSI: 00000000ffffff9c RDI: 0000200000000200 [ 42.759040][ T5767] RBP: 00007ffe2756ade0 R08: 00007ffe2756ae10 R09: 00007ffe2756ae10 [ 42.759045][ T5767] R10: 00007ffe2756ae10 R11: 0000000000000287 R12: 00007ffe2756af38 [ 42.759050][ T5767] R13: 0000000000000002 R14: 00000000004a3de0 R15: 0000000000000002 [ 42.759058][ T5767] [ 42.759060][ T5767] [ 42.759062][ T5767] Allocated by task 5764: [ 42.759068][ T5767] kasan_save_stack+0x30/0x50 [ 42.759075][ T5767] kasan_save_track+0x14/0x30 [ 42.759081][ T5767] __kasan_slab_alloc+0x89/0x90 [ 42.759088][ T5767] kmem_cache_alloc_noprof+0x20e/0x6c0 [ 42.759095][ T5767] configfs_new_dirent+0x52/0x570 [ 42.759105][ T5767] configfs_make_dirent+0x36/0x1a0 [ 42.759116][ T5767] configfs_create_dir+0xbd/0x5c0 [ 42.759127][ T5767] configfs_attach_group+0x2a/0x440 [ 42.759138][ T5767] configfs_mkdir+0x65c/0xb70 [ 42.759149][ T5767] vfs_mkdir+0x361/0x860 [ 42.759156][ T5767] filename_mkdirat+0x491/0x5f0 [ 42.759167][ T5767] __x64_sys_mkdirat+0x89/0xc0 [ 42.759177][ T5767] do_syscall_64+0x115/0x840 [ 42.759184][ T5767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 42.759191][ T5767] [ 42.759192][ T5767] Freed by task 5764: [ 42.759195][ T5767] kasan_save_stack+0x30/0x50 [ 42.759201][ T5767] kasan_save_track+0x14/0x30 [ 42.759207][ T5767] kasan_save_free_info+0x3b/0x70 [ 42.759216][ T5767] __kasan_slab_free+0x5f/0x80 [ 42.759223][ T5767] kmem_cache_free+0x123/0x6a0 [ 42.759245][ T5767] configfs_d_iput+0x20d/0x290 [ 42.759254][ T5767] dentry_unlink_inode+0x265/0x470 [ 42.759265][ T5767] d_delete+0x213/0x280 [ 42.759270][ T5767] vfs_rmdir+0x4ab/0x8b0 [ 42.759278][ T5767] filename_rmdir+0x31a/0x5d0 [ 42.759288][ T5767] __x64_sys_rmdir+0x46/0x70 [ 42.759298][ T5767] do_syscall_64+0x115/0x840 [ 42.759305][ T5767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 42.759312][ T5767] [ 42.759313][ T5767] The buggy address belongs to the object at ffff88804b241f80 [ 42.759313][ T5767] which belongs to the cache configfs_dir_cache of size 96 [ 42.759319][ T5767] The buggy address is located 56 bytes inside of [ 42.759319][ T5767] freed 96-byte region [ffff88804b241f80, ffff88804b241fe0) [ 42.759326][ T5767] [ 42.759327][ T5767] The buggy address belongs to the physical page: [ 42.759331][ T5767] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4b241 [ 42.759339][ T5767] flags: 0x480000000000000(node=1|zone=1) [ 42.759344][ T5767] page_type: f5(slab) [ 42.759351][ T5767] raw: 0480000000000000 ffff888040417780 dead000000000122 0000000000000000 [ 42.759393][ T5767] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 [ 42.759397][ T5767] page dumped because: kasan: bad access detected [ 42.759401][ T5767] page_owner tracks the page as allocated [ 42.759403][ T5767] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5755, tgid 5755 (repro), ts 42727601277, free_ts 42589616669 [ 42.759416][ T5767] post_alloc_hook+0xfd/0x120 [ 42.759426][ T5767] get_page_from_freelist+0xcb6/0x3400 [ 42.759436][ T5767] __alloc_frozen_pages_noprof+0x299/0x2f60 [ 42.759446][ T5767] new_slab+0xa2/0x660 [ 42.759455][ T5767] refill_objects+0xe3/0x460 [ 42.759465][ T5767] __pcs_replace_empty_main+0x17a/0x6d0 [ 42.759483][ T5767] kmem_cache_alloc_noprof+0x4fd/0x6c0 [ 42.759490][ T5767] configfs_new_dirent+0x52/0x570 [ 42.759499][ T5767] configfs_make_dirent+0x36/0x1a0 [ 42.759509][ T5767] configfs_create_file+0xfe/0x180 [ 42.759518][ T5767] configfs_attach_item.part.0+0x147/0x4f0 [ 42.759529][ T5767] configfs_attach_group+0x63/0x440 [ 42.759540][ T5767] create_default_group+0x75/0x180 [ 42.759550][ T5767] configfs_attach_group+0x212/0x440 [ 42.759561][ T5767] configfs_mkdir+0x65c/0xb70 [ 42.759571][ T5767] vfs_mkdir+0x361/0x860 [ 42.759578][ T5767] page last free pid 20 tgid 20 stack trace: [ 42.759581][ T5767] __free_frozen_pages+0x95e/0x1600 [ 42.759590][ T5767] rcu_core+0x5ef/0x1170 [ 42.759599][ T5767] rcu_cpu_kthread+0x1fa/0x410 [ 42.759608][ T5767] smpboot_thread_fn+0x3d3/0xaa0 [ 42.759616][ T5767] kthread+0x370/0x450 [ 42.759625][ T5767] ret_from_fork+0x72b/0xd50 [ 42.759634][ T5767] ret_from_fork_asm+0x1a/0x30 [ 42.759644][ T5767] [ 42.759645][ T5767] Memory state around the buggy address: [ 42.759649][ T5767] ffff88804b241e80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 42.759653][ T5767] ffff88804b241f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 42.759672][ T5767] >ffff88804b241f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 42.759675][ T5767] ^ [ 42.759679][ T5767] ffff88804b242000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.759684][ T5767] ffff88804b242080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.759687][ T5767] ================================================================== [ 42.763360][ T5767] Kernel panic - not syncing: KASAN: panic_on_warn set ... -- Kind regards, Joshua Crofts