[PATCH] configfs: fix slab-use-after-free in configfs_get_config_item()

[PATCH] configfs: fix slab-use-after-free in configfs_get_config_item()

[Igor Putko]

When configfs_symlink() resolves the target via get_target(), it uses
kern_path() which takes a reference on the target's dentry. If a
concurrent rmdir occurs, vfs_rmdir() calls dentry_unhash(). However,
because the dentry's refcount is > 1, dentry_unhash() bails out and
does not actually unhash it.

As a result, when configfs_symlink() subsequently calls
configfs_get_config_item(), it finds the dentry still hashed. It then
calls config_item_get() on sd->s_element. But since the concurrent rmdir
has already proceeded to detach and free the config_item, this leads to
a KASAN slab-use-after-free.

Fix this by taking configfs_dirent_lock inside configfs_get_config_item()
and checking if the CONFIGFS_USET_DROPPING flag is set before taking a
reference on the config_item.

Reported-by: syzbot+6b16e3d085833cbf3e25@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6b16e3d085833cbf3e25
Fixes: 7051a3632669 ("configfs: Infrastructure for configfs items.")
Signed-off-by: Igor Putko <igorpetindev@gmail.com>
---
 fs/configfs/configfs_internal.h | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h
index acdeea8e2..90d6c7515 100644
--- a/fs/configfs/configfs_internal.h
+++ b/fs/configfs/configfs_internal.h
@@ -119,12 +119,23 @@ static inline struct configfs_bin_attribute *to_bin_attr(struct dentry *dentry)
 
 static inline struct config_item *configfs_get_config_item(struct dentry *dentry)
 {
-	struct config_item * item = NULL;
+	struct config_item *item = NULL;
 
 	spin_lock(&dentry->d_lock);
 	if (!d_unhashed(dentry)) {
-		struct configfs_dirent * sd = dentry->d_fsdata;
-		item = config_item_get(sd->s_element);
+		struct configfs_dirent *sd = dentry->d_fsdata;
+
+		if (sd) {
+			/*
+			 * vfs_rmdir() keeps dentry in hash, if d_count > 1.
+			 * Make sure to check the deletion flag while
+			 * holding the lock.
+			 */
+			spin_lock(&configfs_dirent_lock);
+			if (!(sd->s_type & CONFIGFS_USET_DROPPING))
+				item = config_item_get(sd->s_element);
+			spin_unlock(&configfs_dirent_lock);
+		}
 	}
 	spin_unlock(&dentry->d_lock);
 
-- 
2.47.3

Re: [PATCH] configfs: fix slab-use-after-free in configfs_get_config_item()

[Breno Leitao]

On Thu, Jul 30, 2026 at 12:25:02PM +0300, Igor Putko wrote:
> Fix this by taking configfs_dirent_lock inside configfs_get_config_item()
> and checking if the CONFIGFS_USET_DROPPING flag is set before taking a
> reference on the config_item.

How was this tested? 

With this applied, a plain rmdir of any configfs item oopses, because
configfs_rmdir() itself calls this helper on the dentry it is removing,
after it has already set CONFIGFS_USET_DROPPING.

	BUG: kernel NULL pointer dereference, address: 0000000000000040
	RIP: 0010:configfs_rmdir+0x23d/0x3a0
	Call Trace:
	vfs_rmdir+0xbb/0x200
	__x64_sys_rmdir+0x29/0x90

Re: [PATCH] configfs: fix slab-use-after-free in configfs_get_config_item()

[Igor Putko]

Hi Breno,

I see that Vasileios Almpanis has posted a 2-patch series fixing this issue:
https://lore.kernel.org/all/20260730093435.195441-1-vasilisalmpanis@gmail.com/

Please disregard my patch.

Best regards,
Igor