From: Breno Leitao <leitao@debian.org>
To: Joshua Crofts <joshua.crofts1@gmail.com>
Cc: Andreas Hindborg <a.hindborg@kernel.org>,
linux-kernel@vger.kernel.org,
syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com
Subject: Re: [PATCH] configfs: fix refcount warning in configfs_get_config_item()
Date: Wed, 29 Jul 2026 03:06:09 -0700 [thread overview]
Message-ID: <amnP4PTUHSfQqk3h@gmail.com> (raw)
In-Reply-To: <20260729085505.1316-1-joshua.crofts1@gmail.com>
On Wed, Jul 29, 2026 at 08:55:05AM +0000, Joshua Crofts wrote:
> syzbot reported a "refcount_t: addition on 0; use-after-free" warning
> in configfs_get_config_item().
>
> This occurs when configfs_get_config_item() races with a concurrent
> teardown (e.g. rmdir). When the target config_item's refcount drops to
> 0, configfs_get_config_item() calls config_item_get(), which
> unconditionally increments the refcount via kref_get(), triggering the
> refcount warning.
Shouldn't be this the fix we are interested in fixing?
> Fix this by using config_item_get_unless_zero(), which safely returns
> NULL if the refcount is already 0.
This looks like more a workaround than a proper fix, no?
I got the impression that we have a UAF behind this refcount issue, and
this is not being solved by this patch.
next prev parent reply other threads:[~2026-07-29 10:06 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-29 8:55 [PATCH] configfs: fix refcount warning in configfs_get_config_item() Joshua Crofts
2026-07-29 9:00 ` Joshua Crofts
2026-07-29 9:51 ` Jeffin Philip
2026-07-29 13:50 ` Joshua Crofts
2026-07-29 10:06 ` Breno Leitao [this message]
2026-07-29 13:31 ` Joshua Crofts
2026-07-29 15:05 ` Jeffin Philip
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=amnP4PTUHSfQqk3h@gmail.com \
--to=leitao@debian.org \
--cc=a.hindborg@kernel.org \
--cc=joshua.crofts1@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.