From: Al Viro <viro@zeniv.linux.org.uk>
To: Breno Leitao <leitao@debian.org>
Cc: Farhad Alemi <farhad.alemi@berkeley.edu>,
Andreas Hindborg <a.hindborg@kernel.org>,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [BUG] configfs: slab-use-after-free in configfs_drop_dentry() on rmdir
Date: Tue, 2 Jun 2026 08:17:31 +0100 [thread overview]
Message-ID: <20260602071731.GR2636677@ZenIV> (raw)
In-Reply-To: <ahbG94EFLD5ntnYr@gmail.com>
On Wed, May 27, 2026 at 11:27:57AM +0100, Breno Leitao wrote:
> + /*
> + * configfs_create() failed (e.g. -ENOMEM
> + * from new_inode()). The dentry will be
> + * dput()ed by the caller and freed via RCU;
> + * because it never gained an inode,
> + * configfs_d_iput() will not run to clear
> + * sd->s_dentry. Drop the linkage here so a
> + * later detach_attrs() walking the parent's
> + * s_children list does not dereference a
> + * freed dentry in configfs_drop_dentry().
> + */
> + spin_lock(&configfs_dirent_lock);
> + if (sd->s_dentry == dentry)
Don't need that comparison - to get a different ->s_dentry you'd need a lookup
on the same name in the same parent since having dropped configfs_dirent_lock,
and VFS locking guarantees that it won't happen.
IOW, the variant in
https://lore.kernel.org/all/20260519070633.2025485-2-viro@zeniv.linux.org.uk/
should be fine.
prev parent reply other threads:[~2026-06-02 7:17 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-27 3:42 [BUG] configfs: slab-use-after-free in configfs_drop_dentry() on rmdir Farhad Alemi
2026-05-27 10:27 ` Breno Leitao
2026-05-30 17:18 ` Farhad Alemi
2026-06-02 7:17 ` Al Viro [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260602071731.GR2636677@ZenIV \
--to=viro@zeniv.linux.org.uk \
--cc=a.hindborg@kernel.org \
--cc=farhad.alemi@berkeley.edu \
--cc=leitao@debian.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox