All of lore.kernel.org
 help / color / mirror / Atom feed
From: Breno Leitao <leitao@debian.org>
To: Drif Abdelmalek Mohamed Said <drifabdelmalekmohamedsaid@gmail.com>
Cc: Andreas Hindborg <a.hindborg@kernel.org>,
	 Al Viro <viro@zeniv.linux.org.uk>,
	Christian Brauner <brauner@kernel.org>, Jan Kara <jack@suse.cz>,
	 linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com,
	 syzbot+63336d70e1af377d7388@syzkaller.appspotmail.com,
	Ran Hongyun <ranhongyun1@huawei.com>
Subject: Re: [PATCH v3] configfs: fix slab-UAF Write in config_item_put
Date: Fri, 6 Nov 2026 08:43:05 -0800	[thread overview]
Message-ID: <au4DDpKhquR7oXwZ@gmail.com> (raw)
In-Reply-To: <20261105165055.362-1-drifabdelmalekmohamedsaid@gmail.com>

On Thu, Nov 05, 2026 at 05:50:54PM +0100, Drif Abdelmalek Mohamed Said wrote:
> ---
> v3:
>   - Removed redundant null assignment to parent_item

It wasn't redundant, see below.

>  
> +	if (IS_DEADDIR(dir)) {
> +		ret = -ENOENT;
> +		goto out_put_target;
> +	}

I am seeing the following when running this version:

	refcount_t: addition on 0; use-after-free.
	WARNING: lib/refcount.c:34 at refcount_warn_saturate+0x76/0xd0, CPU#1: ln/172
	Call Trace:

Can you help me to understand how this was tested?

Thanks,
--breno


  reply	other threads:[~2026-11-06 16:43 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-05 16:50 [PATCH v3] configfs: fix slab-UAF Write in config_item_put Drif Abdelmalek Mohamed Said
2026-11-06 16:43 ` Breno Leitao [this message]
2026-11-06 17:30   ` DRIF ABDELMALEK MOHAMED SAID
2026-11-09 14:19     ` Breno Leitao
2026-11-08 20:42 ` [syzbot ci] " syzbot ci
2026-11-09 14:32 ` [PATCH v3] " Breno Leitao

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=au4DDpKhquR7oXwZ@gmail.com \
    --to=leitao@debian.org \
    --cc=a.hindborg@kernel.org \
    --cc=brauner@kernel.org \
    --cc=drifabdelmalekmohamedsaid@gmail.com \
    --cc=jack@suse.cz \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=ranhongyun1@huawei.com \
    --cc=syzbot+63336d70e1af377d7388@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.