From: syzbot <syzbot+6b16e3d085833cbf3e25@syzkaller.appspotmail.com>
To: jchuang26@m.fudan.edu.cn, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [fs?] KASAN: slab-use-after-free Write in config_item_get
Date: Sun, 13 Sep 2026 19:03:03 -0700 [thread overview]
Message-ID: <6aa755d7.a211d2ce.1a5198.0289.GAE@google.com> (raw)
In-Reply-To: <6aa74ffd.2cd27cd2.290120.3dbeSMTPIN_ADDED_BROKEN@gmr-mx.google.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Write in config_item_get
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
BUG: KASAN: slab-use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
BUG: KASAN: slab-use-after-free in __refcount_add include/linux/refcount.h:283 [inline]
BUG: KASAN: slab-use-after-free in __refcount_inc include/linux/refcount.h:366 [inline]
BUG: KASAN: slab-use-after-free in refcount_inc include/linux/refcount.h:383 [inline]
BUG: KASAN: slab-use-after-free in kref_get include/linux/kref.h:45 [inline]
BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90 fs/configfs/item.c:104
Write of size 4 at addr ffff88804491f01c by task syz.1.545/7868
CPU: 1 UID: 0 PID: 7868 Comm: syz.1.545 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
__refcount_add include/linux/refcount.h:283 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
kref_get include/linux/kref.h:45 [inline]
config_item_get+0x26/0x90 fs/configfs/item.c:104
get_target fs/configfs/symlink.c:139 [inline]
configfs_symlink+0x407/0x11d0 fs/configfs/symlink.c:200
vfs_symlink+0x18b/0x330 fs/namei.c:5794
filename_symlinkat+0x1cd/0x420 fs/namei.c:5819
__do_sys_symlinkat fs/namei.c:5839 [inline]
__se_sys_symlinkat+0x4e/0x2b0 fs/namei.c:5834
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
Tested on:
commit: a7c1290e configfs: pin the symlink target's dirent ins..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1626c115580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6d794b10c2a1184e
dashboard link: https://syzkaller.appspot.com/bug?extid=6b16e3d085833cbf3e25
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Note: no patches were applied.
next parent reply other threads:[~2026-09-14 2:03 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <6aa74ffd.2cd27cd2.290120.3dbeSMTPIN_ADDED_BROKEN@gmr-mx.google.com>
2026-09-14 2:03 ` syzbot [this message]
[not found] <6aa3ec49.faa14f7e.2f7ba7.7c6fSMTPIN_ADDED_BROKEN@gmr-mx.google.com>
2026-09-11 13:16 ` [syzbot] [fs?] KASAN: slab-use-after-free Write in config_item_get syzbot
[not found] <6aa3b8a3.df8406c6.e4681.4ae6SMTPIN_ADDED_BROKEN@gmr-mx.google.com>
2026-09-11 8:44 ` syzbot
[not found] <SI2PR03MB564251F6E74EDBC70B1BA6C5C0BF2@SI2PR03MB5642.apcprd03.prod.outlook.com>
2026-09-10 12:47 ` syzbot
2026-07-30 0:19 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6aa755d7.a211d2ce.1a5198.0289.GAE@google.com \
--to=syzbot+6b16e3d085833cbf3e25@syzkaller.appspotmail.com \
--cc=jchuang26@m.fudan.edu.cn \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.