* [BUG] configfs: slab-use-after-free in configfs_drop_dentry() on rmdir
@ 2026-05-27 3:42 Farhad Alemi
2026-05-27 10:27 ` Breno Leitao
0 siblings, 1 reply; 4+ messages in thread
From: Farhad Alemi @ 2026-05-27 3:42 UTC (permalink / raw)
To: Andreas Hindborg; +Cc: Breno Leitao, linux-fsdevel, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 4320 bytes --]
Hello Andreas and the configfs team,
I am reporting a configfs use-after-free found by syzkaller.
Summary:
A configfs config-item rmdir(2) can land in configfs_drop_dentry() with
sd->s_dentry pointing at a dentry whose RCU grace period has not yet
elapsed. The spin_lock(&dentry->d_lock) at fs/configfs/inode.c:209 then
reads freed slab memory and KASAN reports a slab-use-after-free.
The race is between an earlier openat path (via lookup_open ->
d_alloc_parallel) that allocates a child dentry, hits an error and
takes the dput()/__dentry_kill()/call_rcu() free path, and a later
rmdir on the same config item that walks the children via
detach_attrs() and grabs &dentry->d_lock before the RCU grace period
elapses.
Observed on:
- Linux v6.17.8 x86_64, QEMU Q35
- KASAN enabled; panic_on_warn set
- The only local dirty file in my tree is drivers/tty/serial/serial_core.c,
containing a local ttyS0 console guard for the fuzzing harness. It is
unrelated to fs/configfs/.
- Trigger does not require a crafted on-disk state; configfs is in-memory.
However, the syz reproducer uses fault injection (CONFIG_FAULT_INJECTION)
to force the openat error path on the Nth allocation. Without fault
injection the race is plausibly still reachable but timing-dependent.
Impact:
A configfs config-item rmdir races with a still-pending dentry RCU free
and KASAN reports a UAF read in the spin_lock:
BUG: KASAN: slab-use-after-free in __raw_spin_lock
include/linux/spinlock_api_smp.h:133 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x33/0x40
kernel/locking/spinlock.c:154
Read of size 1 at addr ffff888133d5a538 by task syz.2.275/4076
Allocator (openat path):
__d_alloc+0x3b/0x7b0 fs/dcache.c:1690
d_alloc_parallel+0xeb/0x1620 fs/dcache.c:2549
lookup_open fs/namei.c:3638 [inline]
open_last_lookups fs/namei.c:3815 [inline]
path_openat+0xa6b/0x3890 fs/namei.c:4051
do_filp_open+0x232/0x490 fs/namei.c:4081
do_sys_openat2+0x134/0x1e0 fs/open.c:1437
__x64_sys_openat+0x13d/0x170 fs/open.c:1463
Free path (RCU dput, softirq):
kmem_cache_free+0x18f/0x3f0 mm/slub.c:4812
rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0xd1e/0x1800 kernel/rcu/tree.c:2861
Crashing path (rmdir):
_raw_spin_lock+0x33/0x40 kernel/locking/spinlock.c:154
configfs_drop_dentry+0x5c/0x150 fs/configfs/inode.c:209
detach_attrs+0x22b/0x2f0 fs/configfs/dir.c:588
configfs_detach_item fs/configfs/dir.c:870 [inline]
configfs_detach_group fs/configfs/dir.c:917 [inline]
configfs_rmdir+0x652/0x9f0 fs/configfs/dir.c:1551
vfs_rmdir+0x3c2/0x530 fs/namei.c:4469
do_rmdir+0x275/0x540 fs/namei.c:4524
__x64_sys_rmdir+0x4c/0x60 fs/namei.c:4541
Expected behavior:
configfs_drop_dentry()'s read of sd->s_dentry and the subsequent
spin_lock(&dentry->d_lock) need to be safe against a concurrent
RCU-deferred dentry free. Plausible directions: hold the parent's
i_lock around the sd->s_dentry read + spin_lock; rcu_read_lock() to
keep the slab from being recycled while we attempt to lock; or have
configfs hold an explicit reference on sd->s_dentry while it lives in
the children list.
Reproducer:
A generated C reproducer was not produced for this seed. The syz
program is attached as reproducer.syz; the salient operation sequence
is:
1. mkdir + mount configfs
2. openat the null_blk backend ("nullb")
3. mkdirat a new config item under nullb
4. openat one of its attributes with fault injection (fail_nth=7),
which takes the dput()/RCU-free path on the freshly-allocated
dentry
5. additional openat + write syscalls (incidental to the race)
6. rmdir the config item, which reaches configfs_drop_dentry()
before the RCU grace period for step 4's freed dentry has
elapsed
The console report is attached as crash-report.txt.
Novelty check:
I searched syzbot dashboard data across upstream, fixed, invalid, stable,
and Android namespaces, and searched lore.kernel.org for
"configfs_drop_dentry", "detach_attrs" + "UAF", and "configfs_rmdir" +
"KASAN". I did not find an exact match. There are unrelated configfs
default-group / PCI-endpoint race reports, but those have different
code paths and free sites.
I appreciate your time and consideration, and I'm grateful for your
work on this subsystem. I'd be glad to test any candidate patches.
Regards,
[-- Attachment #2: crash-report.txt --]
[-- Type: text/plain, Size: 9055 bytes --]
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f48fd005fa0 R14: 00007f48fd005fa0 R15: 0000000000001185
</TASK>
==================================================================
BUG: KASAN: slab-use-after-free in __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x33/0x40 kernel/locking/spinlock.c:154
Read of size 1 at addr ffff888133d5a538 by task syz.2.275/4076
CPU: 1 UID: 0 PID: 4076 Comm: syz.2.275 Not tainted 6.17.8 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x1a9/0x280 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
__kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568
kasan_check_byte include/linux/kasan.h:399 [inline]
lock_acquire+0x8d/0x350 kernel/locking/lockdep.c:5842
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x33/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
configfs_drop_dentry+0x5c/0x150 fs/configfs/inode.c:209
detach_attrs+0x22b/0x2f0 fs/configfs/dir.c:588
configfs_detach_item fs/configfs/dir.c:870 [inline]
configfs_detach_group fs/configfs/dir.c:917 [inline]
configfs_rmdir+0x652/0x9f0 fs/configfs/dir.c:1551
vfs_rmdir+0x3c2/0x530 fs/namei.c:4469
do_rmdir+0x275/0x540 fs/namei.c:4524
__do_sys_rmdir fs/namei.c:4543 [inline]
__se_sys_rmdir fs/namei.c:4541 [inline]
__x64_sys_rmdir+0x4c/0x60 fs/namei.c:4541
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf0/0x390 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f48fcd7778d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffbceab7a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f48fd005fa0 RCX: 00007f48fcd7778d
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000002c0
RBP: 00007f48fce1eb3d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f48fd005fa0 R14: 00007f48fd005fa0 R15: 0000000000001677
</TASK>
Allocated by task 4076:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:330 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:356
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4206 [inline]
slab_alloc_node mm/slub.c:4255 [inline]
kmem_cache_alloc_lru_noprof+0x1c2/0x3b0 mm/slub.c:4274
__d_alloc+0x3b/0x7b0 fs/dcache.c:1690
d_alloc_parallel+0xeb/0x1620 fs/dcache.c:2549
lookup_open fs/namei.c:3638 [inline]
open_last_lookups fs/namei.c:3815 [inline]
path_openat+0xa6b/0x3890 fs/namei.c:4051
do_filp_open+0x232/0x490 fs/namei.c:4081
do_sys_openat2+0x134/0x1e0 fs/open.c:1437
do_sys_open fs/open.c:1452 [inline]
__do_sys_openat fs/open.c:1468 [inline]
__se_sys_openat fs/open.c:1463 [inline]
__x64_sys_openat+0x13d/0x170 fs/open.c:1463
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf0/0x390 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 15:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2437 [inline]
slab_free mm/slub.c:4710 [inline]
kmem_cache_free+0x18f/0x3f0 mm/slub.c:4812
rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0xd1e/0x1800 kernel/rcu/tree.c:2861
handle_softirqs+0x278/0x870 kernel/softirq.c:579
run_ksoftirqd+0xac/0x110 kernel/softirq.c:968
smpboot_thread_fn+0x546/0xa50 kernel/smpboot.c:160
kthread+0x728/0x8b0 kernel/kthread.c:463
ret_from_fork+0x452/0x7d0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:47
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:548
__call_rcu_common kernel/rcu/tree.c:3123 [inline]
call_rcu+0x157/0x9e0 kernel/rcu/tree.c:3243
__dentry_kill+0x4d7/0x660 fs/dcache.c:688
dput+0x1a4/0x2b0 fs/dcache.c:911
lookup_open fs/namei.c:3728 [inline]
open_last_lookups fs/namei.c:3815 [inline]
path_openat+0x1536/0x3890 fs/namei.c:4051
do_filp_open+0x232/0x490 fs/namei.c:4081
do_sys_openat2+0x134/0x1e0 fs/open.c:1437
do_sys_open fs/open.c:1452 [inline]
__do_sys_openat fs/open.c:1468 [inline]
__se_sys_openat fs/open.c:1463 [inline]
__x64_sys_openat+0x13d/0x170 fs/open.c:1463
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf0/0x390 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888133d5a468
which belongs to the cache dentry of size 312
The buggy address is located 208 bytes inside of
freed 312-byte region [ffff888133d5a468, ffff888133d5a5a0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x133d5a
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888137c44901
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff8881016a6640 ffffea0004955500 dead000000000002
raw: 0000000000000000 0000000080150015 00000000f5000000 ffff888137c44901
head: 0200000000000040 ffff8881016a6640 ffffea0004955500 dead000000000002
head: 0000000000000000 0000000080150015 00000000f5000000 ffff888137c44901
head: 0200000000000001 ffffea0004cf5681 00000000ffffffff 00000000ffffffff
head: 00000007f014aaa9 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3263, tgid 3263 ((udev-worker)), ts 66383627308, free_ts 59690661564
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x280 mm/page_alloc.c:1851
prep_new_page mm/page_alloc.c:1859 [inline]
get_page_from_freelist+0x2124/0x2290 mm/page_alloc.c:3858
__alloc_frozen_pages_noprof+0x192/0x380 mm/page_alloc.c:5148
alloc_pages_mpol+0xd6/0x330 mm/mempolicy.c:2416
alloc_slab_page mm/slub.c:2507 [inline]
allocate_slab+0x8f/0x320 mm/slub.c:2675
new_slab mm/slub.c:2729 [inline]
___slab_alloc+0xbdc/0x1400 mm/slub.c:3916
__slab_alloc mm/slub.c:4007 [inline]
__slab_alloc_node mm/slub.c:4082 [inline]
slab_alloc_node mm/slub.c:4243 [inline]
kmem_cache_alloc_lru_noprof+0x280/0x3b0 mm/slub.c:4274
__d_alloc+0x3b/0x7b0 fs/dcache.c:1690
d_alloc_parallel+0xeb/0x1620 fs/dcache.c:2549
__lookup_slow+0x13c/0x420 fs/namei.c:1801
lookup_slow+0x58/0x80 fs/namei.c:1833
walk_component+0x2d7/0x410 fs/namei.c:2137
lookup_last fs/namei.c:2638 [inline]
path_lookupat+0x168/0x440 fs/namei.c:2662
filename_lookup+0x25b/0x5d0 fs/namei.c:2691
vfs_statx+0x11a/0x570 fs/stat.c:353
vfs_fstatat+0x11d/0x170 fs/stat.c:375
page last free pid 2546 tgid 2546 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
free_unref_folios+0xca1/0x1390 mm/page_alloc.c:2952
folios_put_refs+0x46f/0x560 mm/swap.c:999
free_pages_and_swap_cache+0x2ec/0x5b0 mm/swap_state.c:264
__tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
tlb_flush_mmu+0x3ab/0x690 mm/mmu_gather.c:404
tlb_finish_mmu+0xc8/0x1d0 mm/mmu_gather.c:497
vms_clear_ptes+0x45a/0x580 mm/vma.c:1235
vms_complete_munmap_vmas+0x20a/0x890 mm/vma.c:1277
do_vmi_align_munmap+0x3a7/0x490 mm/vma.c:1536
do_vmi_munmap+0x257/0x2e0 mm/vma.c:1584
__vm_munmap+0x270/0x400 mm/vma.c:3155
__do_sys_munmap mm/mmap.c:1080 [inline]
__se_sys_munmap mm/mmap.c:1077 [inline]
__x64_sys_munmap+0x65/0x80 mm/mmap.c:1077
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf0/0x390 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888133d5a400: 00 00 00 00 00 fc fc fc fc fc fc fc fc fa fb fb
ffff888133d5a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888133d5a500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888133d5a580: fb fb fb fb fc fc fc fc fc fc fc fc 00 00 00 00
ffff888133d5a600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
[-- Attachment #3: reproducer.syz --]
[-- Type: application/octet-stream, Size: 923 bytes --]
# {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
mkdir(&(0x7f0000000040)='./pm242cfg\x00', 0x0)
mount(0x0, &(0x7f0000000080)='./pm242cfg\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./pm242cfg/nullb\x00', 0x0, 0x0)
mkdirat(r0, &(0x7f0000000140)='pm242rel\x00', 0x0)
openat(r0, &(0x7f00000001c0)='pm242rel/memory_backed\x00', 0x1, 0x0) (fail_nth: 7)
r1 = openat(r0, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000280)='1\n', 0x2)
rmdir(&(0x7f00000002c0)='./pm242cfg/nullb/pm242rel')
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [BUG] configfs: slab-use-after-free in configfs_drop_dentry() on rmdir
2026-05-27 3:42 [BUG] configfs: slab-use-after-free in configfs_drop_dentry() on rmdir Farhad Alemi
@ 2026-05-27 10:27 ` Breno Leitao
2026-05-30 17:18 ` Farhad Alemi
2026-06-02 7:17 ` Al Viro
0 siblings, 2 replies; 4+ messages in thread
From: Breno Leitao @ 2026-05-27 10:27 UTC (permalink / raw)
To: Farhad Alemi; +Cc: Andreas Hindborg, linux-fsdevel, linux-kernel
On Tue, May 26, 2026 at 08:42:00PM +0000, Farhad Alemi wrote:
> Hello Andreas and the configfs team,
>
> I am reporting a configfs use-after-free found by syzkaller.
>
> Summary:
> A configfs config-item rmdir(2) can land in configfs_drop_dentry() with
> sd->s_dentry pointing at a dentry whose RCU grace period has not yet
> elapsed. The spin_lock(&dentry->d_lock) at fs/configfs/inode.c:209 then
> reads freed slab memory and KASAN reports a slab-use-after-free.
Thanks for the report. I was able to reproduce it on linus' upstream
tree.
I've came up with the following fix, would you mind trying it, please?
commit d78c04736ef0ede76093c780a188560b6baed3c3
Author: Breno Leitao <leitao@debian.org>
Date: Wed May 27 06:25:49 2026 -0400
configfs: fix UAF in configfs_drop_dentry() after failed attribute lookup
When configfs_lookup() matches an attribute it publishes the new dentry
into sd->s_dentry (and dentry->d_fsdata) before calling
configfs_create() to allocate the inode:
dentry->d_fsdata = configfs_get(sd);
sd->s_dentry = dentry;
spin_unlock(&configfs_dirent_lock);
inode = configfs_create(dentry, mode);
if (IS_ERR(inode)) {
configfs_put(sd);
return ERR_CAST(inode);
}
If configfs_create() fails (e.g. new_inode() returns NULL under memory
pressure or fault injection), the lookup returns an error and the
caller dputs the now-negative dentry, which goes through
__dentry_kill() and is freed via call_rcu().
Because the dentry never gained an inode it does not go through the
.d_iput op (configfs_d_iput), which is the only place that clears
sd->s_dentry. sd therefore keeps a stale pointer to the freed dentry.
A subsequent rmdir of the parent item walks the parent's s_children
list in detach_attrs() and configfs_drop_dentry() does
spin_lock(&sd->s_dentry->d_lock) on freed memory:
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xac/0x110
Read of size 1 at addr ffff00012bacd028 by task repro/2440
_raw_spin_lock+0xac/0x110
configfs_drop_dentry+0x48/0x158 [configfs]
detach_attrs.isra.0+0x18c/0x494 [configfs]
configfs_rmdir+0x450/0x71c [configfs]
vfs_rmdir+0x170/0x620
...
Freed by task 0:
__d_free+0x28/0x34
rcu_do_batch+0x37c/0x1bd0
...
Last potentially related work creation:
call_rcu+0x34/0x68
dentry_free+0xe8/0x3e0
__dentry_kill+0x404/0x604
dput+0x14/0x30
lookup_open.isra.0+0x6ac/0xc00
path_openat+0xd18/0x2588
Fix this by tearing down the sd<->dentry linkage in the
configfs_create() error path, under configfs_dirent_lock, mirroring
what configfs_d_iput() would have done for a positive dentry.
Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Signed-off-by: Breno Leitao <leitao@debian.org>
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 362b6ff9b908..68d857dcb2d9 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -486,6 +486,22 @@ static struct dentry * configfs_lookup(struct inode *dir,
inode = configfs_create(dentry, mode);
if (IS_ERR(inode)) {
+ /*
+ * configfs_create() failed (e.g. -ENOMEM
+ * from new_inode()). The dentry will be
+ * dput()ed by the caller and freed via RCU;
+ * because it never gained an inode,
+ * configfs_d_iput() will not run to clear
+ * sd->s_dentry. Drop the linkage here so a
+ * later detach_attrs() walking the parent's
+ * s_children list does not dereference a
+ * freed dentry in configfs_drop_dentry().
+ */
+ spin_lock(&configfs_dirent_lock);
+ if (sd->s_dentry == dentry)
+ sd->s_dentry = NULL;
+ dentry->d_fsdata = NULL;
+ spin_unlock(&configfs_dirent_lock);
configfs_put(sd);
return ERR_CAST(inode);
}
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [BUG] configfs: slab-use-after-free in configfs_drop_dentry() on rmdir
2026-05-27 10:27 ` Breno Leitao
@ 2026-05-30 17:18 ` Farhad Alemi
2026-06-02 7:17 ` Al Viro
1 sibling, 0 replies; 4+ messages in thread
From: Farhad Alemi @ 2026-05-30 17:18 UTC (permalink / raw)
To: Breno Leitao; +Cc: Andreas Hindborg, linux-fsdevel, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 5253 bytes --]
Hi Breno,
Thanks for sending the patch. I applied your patch on top of v7.1-rc5
e7ae89a0c97ce2b68b0983cd01eda67cf373517d and rebuilt with the same
config that originally caught this. The attached reproducer now runs
without causing a panic. Without the patch, the same reproducer still
trips it.
Please feel free to add:
Tested-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Thanks again,
On Wed, May 27, 2026 at 3:27 AM Breno Leitao <leitao@debian.org> wrote:
>
> On Tue, May 26, 2026 at 08:42:00PM +0000, Farhad Alemi wrote:
> > Hello Andreas and the configfs team,
> >
> > I am reporting a configfs use-after-free found by syzkaller.
> >
> > Summary:
> > A configfs config-item rmdir(2) can land in configfs_drop_dentry() with
> > sd->s_dentry pointing at a dentry whose RCU grace period has not yet
> > elapsed. The spin_lock(&dentry->d_lock) at fs/configfs/inode.c:209 then
> > reads freed slab memory and KASAN reports a slab-use-after-free.
>
> Thanks for the report. I was able to reproduce it on linus' upstream
> tree.
>
> I've came up with the following fix, would you mind trying it, please?
>
>
> commit d78c04736ef0ede76093c780a188560b6baed3c3
> Author: Breno Leitao <leitao@debian.org>
> Date: Wed May 27 06:25:49 2026 -0400
>
> configfs: fix UAF in configfs_drop_dentry() after failed attribute lookup
>
> When configfs_lookup() matches an attribute it publishes the new dentry
> into sd->s_dentry (and dentry->d_fsdata) before calling
> configfs_create() to allocate the inode:
>
> dentry->d_fsdata = configfs_get(sd);
> sd->s_dentry = dentry;
> spin_unlock(&configfs_dirent_lock);
>
> inode = configfs_create(dentry, mode);
> if (IS_ERR(inode)) {
> configfs_put(sd);
> return ERR_CAST(inode);
> }
>
> If configfs_create() fails (e.g. new_inode() returns NULL under memory
> pressure or fault injection), the lookup returns an error and the
> caller dputs the now-negative dentry, which goes through
> __dentry_kill() and is freed via call_rcu().
>
> Because the dentry never gained an inode it does not go through the
> .d_iput op (configfs_d_iput), which is the only place that clears
> sd->s_dentry. sd therefore keeps a stale pointer to the freed dentry.
> A subsequent rmdir of the parent item walks the parent's s_children
> list in detach_attrs() and configfs_drop_dentry() does
> spin_lock(&sd->s_dentry->d_lock) on freed memory:
>
> BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xac/0x110
> Read of size 1 at addr ffff00012bacd028 by task repro/2440
> _raw_spin_lock+0xac/0x110
> configfs_drop_dentry+0x48/0x158 [configfs]
> detach_attrs.isra.0+0x18c/0x494 [configfs]
> configfs_rmdir+0x450/0x71c [configfs]
> vfs_rmdir+0x170/0x620
> ...
> Freed by task 0:
> __d_free+0x28/0x34
> rcu_do_batch+0x37c/0x1bd0
> ...
> Last potentially related work creation:
> call_rcu+0x34/0x68
> dentry_free+0xe8/0x3e0
> __dentry_kill+0x404/0x604
> dput+0x14/0x30
> lookup_open.isra.0+0x6ac/0xc00
> path_openat+0xd18/0x2588
>
> Fix this by tearing down the sd<->dentry linkage in the
> configfs_create() error path, under configfs_dirent_lock, mirroring
> what configfs_d_iput() would have done for a positive dentry.
>
> Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
> Signed-off-by: Breno Leitao <leitao@debian.org>
>
> diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
> index 362b6ff9b908..68d857dcb2d9 100644
> --- a/fs/configfs/dir.c
> +++ b/fs/configfs/dir.c
> @@ -486,6 +486,22 @@ static struct dentry * configfs_lookup(struct inode *dir,
>
> inode = configfs_create(dentry, mode);
> if (IS_ERR(inode)) {
> + /*
> + * configfs_create() failed (e.g. -ENOMEM
> + * from new_inode()). The dentry will be
> + * dput()ed by the caller and freed via RCU;
> + * because it never gained an inode,
> + * configfs_d_iput() will not run to clear
> + * sd->s_dentry. Drop the linkage here so a
> + * later detach_attrs() walking the parent's
> + * s_children list does not dereference a
> + * freed dentry in configfs_drop_dentry().
> + */
> + spin_lock(&configfs_dirent_lock);
> + if (sd->s_dentry == dentry)
> + sd->s_dentry = NULL;
> + dentry->d_fsdata = NULL;
> + spin_unlock(&configfs_dirent_lock);
> configfs_put(sd);
> return ERR_CAST(inode);
> }
[-- Attachment #2: reproducer.c --]
[-- Type: application/octet-stream, Size: 17728 bytes --]
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
#include <linux/capability.h>
static __thread int clone_ongoing;
static __thread int skip_segv;
static __thread jmp_buf segv_env;
static void segv_handler(int sig, siginfo_t* info, void* ctx)
{
if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
exit(sig);
}
uintptr_t addr = (uintptr_t)info->si_addr;
const uintptr_t prog_start = 1 << 20;
const uintptr_t prog_end = 100 << 20;
int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
int valid = addr < prog_start || addr > prog_end;
if (skip && valid) {
_longjmp(segv_env, 1);
}
exit(sig);
}
static void install_segv_handler(void)
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_handler = SIG_IGN;
syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
memset(&sa, 0, sizeof(sa));
sa.sa_sigaction = segv_handler;
sa.sa_flags = SA_NODEFER | SA_SIGINFO;
sigaction(SIGSEGV, &sa, NULL);
sigaction(SIGBUS, &sa, NULL);
}
#define NONFAILING(...) \
({ \
int ok = 1; \
__atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
if (_setjmp(segv_env) == 0) { \
__VA_ARGS__; \
} else \
ok = 0; \
__atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
ok; \
})
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}
static void setup_gadgetfs();
static void setup_binderfs();
static void setup_fusectl();
static void sandbox_common_mount_tmpfs(void)
{
write_file("/proc/sys/fs/mount-max", "100000");
if (mkdir("./syz-tmp", 0777))
exit(1);
if (mount("", "./syz-tmp", "tmpfs", 0, NULL))
exit(1);
if (mkdir("./syz-tmp/newroot", 0777))
exit(1);
if (mkdir("./syz-tmp/newroot/dev", 0700))
exit(1);
unsigned bind_mount_flags = MS_BIND | MS_REC | MS_PRIVATE;
if (mount("/dev", "./syz-tmp/newroot/dev", NULL, bind_mount_flags, NULL))
exit(1);
if (mkdir("./syz-tmp/newroot/proc", 0700))
exit(1);
if (mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL))
exit(1);
if (mkdir("./syz-tmp/newroot/selinux", 0700))
exit(1);
const char* selinux_path = "./syz-tmp/newroot/selinux";
if (mount("/selinux", selinux_path, NULL, bind_mount_flags, NULL)) {
if (errno != ENOENT)
exit(1);
if (mount("/sys/fs/selinux", selinux_path, NULL, bind_mount_flags, NULL) &&
errno != ENOENT)
exit(1);
}
if (mkdir("./syz-tmp/newroot/sys", 0700))
exit(1);
if (mount("/sys", "./syz-tmp/newroot/sys", 0, bind_mount_flags, NULL))
exit(1);
if (mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL,
bind_mount_flags, NULL) &&
errno != ENOENT)
exit(1);
if (mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL,
bind_mount_flags, NULL) &&
errno != ENOENT)
exit(1);
if (mount("/proc/sys/fs/binfmt_misc",
"./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, bind_mount_flags,
NULL) &&
errno != ENOENT)
exit(1);
if (mkdir("./syz-tmp/newroot/syz-inputs", 0700))
exit(1);
if (mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL,
bind_mount_flags | MS_RDONLY, NULL) &&
errno != ENOENT)
exit(1);
if (mkdir("./syz-tmp/pivot", 0777))
exit(1);
if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) {
if (chdir("./syz-tmp"))
exit(1);
} else {
if (chdir("/"))
exit(1);
if (umount2("./pivot", MNT_DETACH))
exit(1);
}
if (chroot("./newroot"))
exit(1);
if (chdir("/"))
exit(1);
setup_gadgetfs();
setup_binderfs();
setup_fusectl();
}
static void setup_gadgetfs()
{
if (mkdir("/dev/gadgetfs", 0777)) {
}
if (mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL)) {
}
}
static void setup_fusectl()
{
if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
}
}
static void setup_binderfs()
{
if (mkdir("/dev/binderfs", 0777)) {
}
if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) {
}
}
static void loop();
static void sandbox_common()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
if (getppid() == 1)
exit(1);
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = (200 << 20);
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 32 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 136 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
if (unshare(CLONE_NEWNS)) {
}
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
}
if (unshare(CLONE_NEWIPC)) {
}
if (unshare(0x02000000)) {
}
if (unshare(CLONE_NEWUTS)) {
}
if (unshare(CLONE_SYSVSEM)) {
}
typedef struct {
const char* name;
const char* value;
} sysctl_t;
static const sysctl_t sysctls[] = {
{"/proc/sys/kernel/shmmax", "16777216"},
{"/proc/sys/kernel/shmall", "536870912"},
{"/proc/sys/kernel/shmmni", "1024"},
{"/proc/sys/kernel/msgmax", "8192"},
{"/proc/sys/kernel/msgmni", "1024"},
{"/proc/sys/kernel/msgmnb", "1024"},
{"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
};
unsigned i;
for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
write_file(sysctls[i].name, sysctls[i].value);
}
static int wait_for_loop(int pid)
{
if (pid < 0)
exit(1);
int status = 0;
while (waitpid(-1, &status, __WALL) != pid) {
}
return WEXITSTATUS(status);
}
static void drop_caps(void)
{
struct __user_cap_header_struct cap_hdr = {};
struct __user_cap_data_struct cap_data[2] = {};
cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
cap_hdr.pid = getpid();
if (syscall(SYS_capget, &cap_hdr, &cap_data))
exit(1);
const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE);
cap_data[0].effective &= ~drop;
cap_data[0].permitted &= ~drop;
cap_data[0].inheritable &= ~drop;
if (syscall(SYS_capset, &cap_hdr, &cap_data))
exit(1);
}
static int do_sandbox_none(void)
{
if (unshare(CLONE_NEWPID)) {
}
int pid = fork();
if (pid != 0)
return wait_for_loop(pid);
sandbox_common();
drop_caps();
if (unshare(CLONE_NEWNET)) {
}
write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535");
sandbox_common_mount_tmpfs();
loop();
exit(1);
}
#define FS_IOC_SETFLAGS _IOW('f', 2, long)
static void remove_dir(const char* dir)
{
int iter = 0;
DIR* dp = 0;
const int umount_flags = MNT_FORCE | UMOUNT_NOFOLLOW;
retry:
while (umount2(dir, umount_flags) == 0) {
}
dp = opendir(dir);
if (dp == NULL) {
if (errno == EMFILE) {
exit(1);
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
while (umount2(filename, umount_flags) == 0) {
}
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
int i;
for (i = 0;; i++) {
if (unlink(filename) == 0)
break;
if (errno == EPERM) {
int fd = open(filename, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno != EBUSY || i > 100)
exit(1);
if (umount2(filename, umount_flags))
exit(1);
}
}
closedir(dp);
for (int i = 0;; i++) {
if (rmdir(dir) == 0)
break;
if (i < 100) {
if (errno == EPERM) {
int fd = open(dir, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno == EBUSY) {
if (umount2(dir, umount_flags))
exit(1);
continue;
}
if (errno == ENOTEMPTY) {
if (iter < 100) {
iter++;
goto retry;
}
}
}
exit(1);
}
}
static int inject_fault(int nth)
{
int fd;
fd = open("/proc/thread-self/fail-nth", O_RDWR);
if (fd == -1)
exit(1);
char buf[16];
sprintf(buf, "%d", nth);
if (write(fd, buf, strlen(buf)) != (ssize_t)strlen(buf))
exit(1);
return fd;
}
static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
for (int i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir);
} else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}
static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
write_file("/proc/self/oom_score_adj", "1000");
if (symlink("/dev/binderfs", "./binderfs")) {
}
}
static const char* setup_fault()
{
int fd = open("/proc/self/make-it-fail", O_WRONLY);
if (fd == -1)
return "CONFIG_FAULT_INJECTION is not enabled";
close(fd);
fd = open("/proc/thread-self/fail-nth", O_WRONLY);
if (fd == -1)
return "kernel does not have systematic fault injection support";
close(fd);
static struct {
const char* file;
const char* val;
bool fatal;
} files[] = {
{"/sys/kernel/debug/failslab/ignore-gfp-wait", "N", true},
{"/sys/kernel/debug/fail_futex/ignore-private", "N", false},
{"/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", "N", false},
{"/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N", false},
{"/sys/kernel/debug/fail_page_alloc/min-order", "0", false},
};
unsigned i;
for (i = 0; i < sizeof(files) / sizeof(files[0]); i++) {
if (!write_file(files[i].file, files[i].val)) {
if (files[i].fatal)
return "failed to write fault injection file";
}
}
return NULL;
}
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
setup_test();
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
sleep_ms(10);
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_one(void)
{
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
}
// mkdir arguments: [
// path: ptr[in, buffer] {
// buffer: {2e 2f 70 6d 32 34 32 63 66 67 00} (length 0xb)
// }
// mode: open_mode = 0x0 (8 bytes)
// ]
NONFAILING(memcpy((void*)0x200000000040, "./pm242cfg\000", 11));
syscall(__NR_mkdir, /*path=*/0x200000000040ul, /*mode=*/0ul);
// mount arguments: [
// src: nil
// dst: ptr[in, buffer] {
// buffer: {2e 2f 70 6d 32 34 32 63 66 67 00} (length 0xb)
// }
// type: ptr[in, buffer] {
// buffer: {63 6f 6e 66 69 67 66 73 00} (length 0x9)
// }
// flags: mount_flags = 0x0 (8 bytes)
// data: nil
// ]
NONFAILING(memcpy((void*)0x200000000080, "./pm242cfg\000", 11));
NONFAILING(memcpy((void*)0x2000000000c0, "configfs\000", 9));
syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000080ul,
/*type=*/0x2000000000c0ul, /*flags=*/0ul, /*data=*/0ul);
// openat$dir arguments: [
// fd: const = 0xffffffffffffff9c (8 bytes)
// file: ptr[in, buffer] {
// buffer: {2e 2f 70 6d 32 34 32 63 66 67 2f 6e 75 6c 6c 62 00} (length
// 0x11)
// }
// flags: open_flags = 0x0 (4 bytes)
// mode: open_mode = 0x0 (2 bytes)
// ]
// returns fd_dir
NONFAILING(memcpy((void*)0x200000000100, "./pm242cfg/nullb\000", 17));
res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
/*file=*/0x200000000100ul, /*flags=*/0, /*mode=*/0);
if (res != -1)
r[0] = res;
// mkdirat arguments: [
// fd: fd_dir (resource)
// path: ptr[in, buffer] {
// buffer: {70 6d 32 34 32 72 65 6c 00} (length 0x9)
// }
// mode: open_mode = 0x0 (8 bytes)
// ]
NONFAILING(memcpy((void*)0x200000000140, "pm242rel\000", 9));
syscall(__NR_mkdirat, /*fd=*/r[0], /*path=*/0x200000000140ul, /*mode=*/0ul);
// openat arguments: [
// fd: fd_dir (resource)
// file: ptr[in, buffer] {
// buffer: {70 6d 32 34 32 72 65 6c 2f 6d 65 6d 6f 72 79 5f 62 61 63 6b
// 65 64 00} (length 0x17)
// }
// flags: open_flags = 0x1 (4 bytes)
// mode: open_mode = 0x0 (2 bytes)
// ]
// returns fd
NONFAILING(memcpy((void*)0x2000000001c0, "pm242rel/memory_backed\000", 23));
inject_fault(7);
syscall(__NR_openat, /*fd=*/r[0], /*file=*/0x2000000001c0ul,
/*flags=O_WRONLY*/ 1, /*mode=*/0);
// openat arguments: [
// fd: fd_dir (resource)
// file: nil
// flags: open_flags = 0x1 (4 bytes)
// mode: open_mode = 0x0 (2 bytes)
// ]
// returns fd
res = syscall(__NR_openat, /*fd=*/r[0], /*file=*/0ul, /*flags=O_WRONLY*/ 1,
/*mode=*/0);
if (res != -1)
r[1] = res;
// write arguments: [
// fd: fd (resource)
// buf: ptr[in, buffer] {
// buffer: {31 0a} (length 0x2)
// }
// count: len = 0x2 (8 bytes)
// ]
NONFAILING(memcpy((void*)0x200000000280, "1\n", 2));
syscall(__NR_write, /*fd=*/r[1], /*buf=*/0x200000000280ul, /*count=*/2ul);
// rmdir arguments: [
// path: ptr[in, buffer] {
// buffer: {2e 2f 70 6d 32 34 32 63 66 67 2f 6e 75 6c 6c 62 2f 70 6d 32
// 34 32 72 65 6c} (length 0x19)
// }
// ]
NONFAILING(memcpy((void*)0x2000000002c0, "./pm242cfg/nullb/pm242rel", 25));
syscall(__NR_rmdir, /*path=*/0x2000000002c0ul);
}
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
/*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
/*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
/*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
/*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
if ((reason = setup_fault()))
printf("the reproducer may not work as expected: fault injection setup "
"failed: %s\n",
reason);
install_segv_handler();
use_temporary_dir();
do_sandbox_none();
return 0;
}
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [BUG] configfs: slab-use-after-free in configfs_drop_dentry() on rmdir
2026-05-27 10:27 ` Breno Leitao
2026-05-30 17:18 ` Farhad Alemi
@ 2026-06-02 7:17 ` Al Viro
1 sibling, 0 replies; 4+ messages in thread
From: Al Viro @ 2026-06-02 7:17 UTC (permalink / raw)
To: Breno Leitao; +Cc: Farhad Alemi, Andreas Hindborg, linux-fsdevel, linux-kernel
On Wed, May 27, 2026 at 11:27:57AM +0100, Breno Leitao wrote:
> + /*
> + * configfs_create() failed (e.g. -ENOMEM
> + * from new_inode()). The dentry will be
> + * dput()ed by the caller and freed via RCU;
> + * because it never gained an inode,
> + * configfs_d_iput() will not run to clear
> + * sd->s_dentry. Drop the linkage here so a
> + * later detach_attrs() walking the parent's
> + * s_children list does not dereference a
> + * freed dentry in configfs_drop_dentry().
> + */
> + spin_lock(&configfs_dirent_lock);
> + if (sd->s_dentry == dentry)
Don't need that comparison - to get a different ->s_dentry you'd need a lookup
on the same name in the same parent since having dropped configfs_dirent_lock,
and VFS locking guarantees that it won't happen.
IOW, the variant in
https://lore.kernel.org/all/20260519070633.2025485-2-viro@zeniv.linux.org.uk/
should be fine.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-06-02 7:17 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-27 3:42 [BUG] configfs: slab-use-after-free in configfs_drop_dentry() on rmdir Farhad Alemi
2026-05-27 10:27 ` Breno Leitao
2026-05-30 17:18 ` Farhad Alemi
2026-06-02 7:17 ` Al Viro
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.