From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f43.google.com (mail-wr1-f43.google.com [209.85.221.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0C1D43DA31 for ; Wed, 29 Jul 2026 09:00:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785315625; cv=none; b=Yb5xmzRHnPFWC/vwVAjv+xofP6RHSqLsZWB9O9L87H7QLm5EedrE9A+ZWi2HaifGocs+8ZFwiY11CyqI8SJc524VXQCzJ+P8qes6m4SlvBZrOmK9Oy6MTbZl0WaDPuXq/iPrWluaSOvEDsrsmXU7H9IWWR9/hVQPAkZZLLzwPn4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785315625; c=relaxed/simple; bh=DrYH7sCjdfRN9vFCC5lGkeXWu+2V7O5K09DbLuhisPw=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=sAOkvjgPNWN7S80bxtkpZ+00aTeQcA1zLS6pTJMUqs76tbCRLeEl32klOnZrA7l4k+8xYDRfEhB/MCSaExDfkYZbZglNNtvuj0wdD1xQmTWQ2lXaSthVXa50fPwoA+DeWlv0Ovg2g0TROC+Vyf3WjUVqh4kKtYlrBdxcF0WPYi4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IM6NHEvs; arc=none smtp.client-ip=209.85.221.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IM6NHEvs" Received: by mail-wr1-f43.google.com with SMTP id ffacd0b85a97d-47f64ca1c2dso206466f8f.2 for ; Wed, 29 Jul 2026 02:00:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785315622; x=1785920422; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=QojDptji9rt162BrNgz2GaSg/e6yImDdE3wrFjoW+Js=; b=IM6NHEvsw501GEvat7faO+/lb7UPIFpjZElJwKI9BJazK2GymwI6rM8KLVMu7wmQBH 4SnmMji5T8ikCmvZ4LStU6yy358SJ+pn18qLDhcrOK9yDNm8SXFKk3h7RS1qq7G6iMM9 +LVb3XHBkU5gGoYYdBJpEUPHqw0P5TAQngrzPsrFofzPSEhhymEROr8uMlgyHdAa3ee/ M+yTDCMp2Dn2UcOFPTDWj4F9wL9no/MWuT7XyBEUqnUQon7cgYR6VJhp0+eNo/UoXuQD 51qWjCCLmX1EqdB4uFpNUrR+HBMTQSGFBG2L+sLr++cbgEmX0Gi92/0YxclNa7qi2GS0 MkLQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785315622; x=1785920422; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=QojDptji9rt162BrNgz2GaSg/e6yImDdE3wrFjoW+Js=; b=Dk+/m+/YA7+rFiD3l2xEV/Q274GOn9dsrsrOW6hKlfil1MqcbTXFZ8RlW3WgTRqunk OWqJMko9ZI76r0MgU9LwT9iuUd09O4eviNsiaqrqWDiHM0XGW74iNM02Ij0S7JtSWk5E LE0XqlzL/b+pkT3SfFNpy5ZhhqH2UGocoEw+otMuyNndFmwChnMfGofm3dDXu+Ybvr2e A0h+Xbd51zh0EPW6YxXl5hk13+rG5u7CTBBcET2CySOlW2jZ8dJ6bEcosya6I14XB5vR rXgiOzcLcGkuNCrKnQy23PKzkam7jcrOd9osxly0yPYh12CB2ks9oGJfImkL1/dq9JxH R2AQ== X-Gm-Message-State: AOJu0YwOxjERZqPNT5l3ctqxt5ZkpqnjBIJkv2xenS8toU468VHA1qac /4lK4pbc6cdgn1oH5iC3wqnVrG7y4NM0i8zhcPlJsfvP7YLc40euxuE9 X-Gm-Gg: AR+sD11IOrIF1HCiXycZCzKSXxJItRNcXfjX51F4f/sFc6KzMu7hD4RUZ7hZN9sRVhm +ZbvD3QZXVoKMVu47cuYneXRLPcV7lBUfKpDtz8/q0XHT3edSxrOrgSv3hN6ltTqMBPqLoFR+qW DJM3wc9lD56Mpo2mnT6elh4WfD5WujoFeIUF5LqMukmhvF04ZRKVi0PmDNjF87T8sPB8CoH3F4O 0WpYjCkXNYLHrot0b0mPJbcYSNEOMuKBD2TtIrseWPej7aO1xEfN2cHaDjWHrxVrXw81K9BdsjC mlPsCanYAsYRngTgamg9CPnu8cscXfaD2Ya/Nj3/0CEuHL/CDgtgpr8sC17XMchdK2AaEiRF5Rr aYjdUcESNzihe5S52AKLT3+UEeNJuecef1u+eT0QALzpGzSLMaCPZ72gAlWgR27fDrScXT/6fq1 75zKHuIHTDwntN/+rM+hVIEluBL4p9Am2Bmzed9h2LOBXCwS2g7lXO61TEhzE7BibflU0jmSlus 8F0ZL4RpSev6bQGvyWNckPwmRT5bIz671Y2GfMLEDZpNgrVgQ+Ucz8HCEYkcHVYjiTNmmlzRJ4D 7E9L6LbPiSQJ4QcROBugtfZKbng6fP+zDflS9uhqWWz7SBHW3+KPb1XSG5N8e3m5KyNMR76MKLh v7K+6iJOgo7b/DctL03vaYa914kPjPx5/BC7EN8XFE/p1WdIlfr93TCz8Qkn8rYcEqJrMK7Y= X-Received: by 2002:a05:6000:178e:b0:47e:bf36:a612 with SMTP id ffacd0b85a97d-47fb1f235e6mr6699321f8f.50.1785315620329; Wed, 29 Jul 2026 02:00:20 -0700 (PDT) Received: from localhost (90-182-112-124.rcp.o2.cz. [90.182.112.124]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47fb6b19653sm6510513f8f.30.2026.07.29.02.00.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 29 Jul 2026 02:00:20 -0700 (PDT) Date: Wed, 29 Jul 2026 11:00:18 +0200 From: Joshua Crofts To: Andreas Hindborg , Breno Leitao Cc: linux-kernel@vger.kernel.org, syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com Subject: Re: [PATCH] configfs: fix refcount warning in configfs_get_config_item() Message-ID: <20260729110018.00005e66@gmail.com> In-Reply-To: <20260729085505.1316-1-joshua.crofts1@gmail.com> References: <20260729085505.1316-1-joshua.crofts1@gmail.com> X-Mailer: Claws Mail 4.4.0 (GTK 3.24.51; x86_64-w64-mingw32) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Wed, 29 Jul 2026 08:55:05 +0000 Joshua Crofts wrote: > syzbot reported a "refcount_t: addition on 0; use-after-free" warning > in configfs_get_config_item(). > > This occurs when configfs_get_config_item() races with a concurrent > teardown (e.g. rmdir). When the target config_item's refcount drops to > 0, configfs_get_config_item() calls config_item_get(), which > unconditionally increments the refcount via kref_get(), triggering the > refcount warning. > > Fix this by using config_item_get_unless_zero(), which safely returns > NULL if the refcount is already 0. > > Reported-by: syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=35790eb7861f8fc57382 > Signed-off-by: Joshua Crofts > --- > fs/configfs/configfs_internal.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h > index acdeea8e2..5448af3a8 100644 > --- a/fs/configfs/configfs_internal.h > +++ b/fs/configfs/configfs_internal.h > @@ -124,7 +124,7 @@ static inline struct config_item *configfs_get_config_item(struct dentry *dentry > spin_lock(&dentry->d_lock); > if (!d_unhashed(dentry)) { > struct configfs_dirent * sd = dentry->d_fsdata; > - item = config_item_get(sd->s_element); > + item = config_item_get_unless_zero(sd->s_element); > } > spin_unlock(&dentry->d_lock); > Forgot to add a Fixes: tag so here it is, will respin if necessary: Fixes: e9c03af21cc7 ("configfs: calculate the symlink target only once") -- Kind regards, Joshua Crofts