From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A9D0B48EBFE for ; Wed, 29 Jul 2026 13:50:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785333016; cv=none; b=BdnBahRAnLJ6luR9/IYrj4DANK3905QhpQHEmryvg+GbvYrkOvt2eN4uumzKMAHtsX8TvBMyUt+jd37aO/IHT6zNSK/GWrtOCLPdk1GYj5GZOU8Vvxorlp/c7j9W+wsRhQbx1FO7r0oCJuN2WAXT+GT9s8xjVY7/By7ubfWlYi0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785333016; c=relaxed/simple; bh=oa61eiujsXPagS3iMrI1SnQkxL5KrHUBng9YGcGknLE=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=uqCuVZdF2dVo8xsWuZNz3meRHRQETpcLbZyfhDg9vgYqW3NHI74lRXETTaxGdh+g1ivwj1t3TKLCXgjRtICg91IsZmyNxDSE6rbJby4xNxyWcpNXQkGXK8blIR0jGnwGZVSJVlq78imIMAQ0sN/W3mrC5M8z8a34246MD0tMq5s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=EideCUXJ; arc=none smtp.client-ip=209.85.221.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="EideCUXJ" Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-47ddf7b09e5so1057120f8f.1 for ; Wed, 29 Jul 2026 06:50:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785333003; x=1785937803; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=2TPr1c4HTZCGCcVNtdozv3W4QEUb8AxVt5iYNLgOPH8=; b=EideCUXJTVdht0hD1UuQ5jzLM8fsR07mgNurP/CSfxpOnqXMVhT0APHeXZ2i6arRCg tjTGnYjz2lSixtjAKv95KiRoS/x7wtbWl7OwNMRziCjahkwoQYxL9Bi9ih4L0kxVAjEe uB/YD2CBVDMNnfwRJILlOF89yFl+tpMp98QlfTTYlahEL/6TKfApaHgvCR070O5GgJOT 8f5nTiUbRuoil3/6xPeCM921R0dpAGYQIokQjNfdnQtCPDmyXZ+A109/G5+AGtpSTUrl v6zpxjBV2psTdeOfGFQHQePcMw2AlGCiOhzOTK4KtHTxIwEQLBnwkNYiiViTJxPws9LL 1Zew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785333003; x=1785937803; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=2TPr1c4HTZCGCcVNtdozv3W4QEUb8AxVt5iYNLgOPH8=; b=aupu9ECwsXzGx9ZFYa50ezLzOc95XPMGiQTpsq8CywGT6f/TEDvOrhYNGZuNl57fKn uZ9rBMEe5zxkMcNxnx1hMrmi7n1K62zgxQNcpsBgYJ0xcXfyY45Z6jHB5caKa04Y2GN+ Dw0V/WnQgb+0WkimAvfsfAk297EdJjBWB1/kLqNhiFQGHYbfBm9w+wsX3n4Of7IKxO3R OCW0SFPA35esxwo+GDbq7z814UhXYrvEmyDGDsfdVskz1lIO8wOEZXVpVSlAiOTpzKCL XbQM/fXr8ToDynO0OlsoOlsMVN32aLoCnqUH/5257JGeB5zeqAo0gU5LXKAray+i+biA uwww== X-Forwarded-Encrypted: i=1; AHgh+Rqz5GSatVq8jjKnDdmwlg+xf/athCJAPBrKsodWxw2XkyjpUwth+fM46A8AiVPEEDvVdBsbZ4bOxbopJXU=@vger.kernel.org X-Gm-Message-State: AOJu0YwsxVSRPdKrxAwnkxBAeJGbtRySe4nub3dxGIQyH8cQsaW8qiwk Ci5pivRBUZeholYjJct4CROo7iyY/NfB5xmoR6hxvxDlJypqo6hQMib0YFHPBucjfbw= X-Gm-Gg: AR+sD13Bknx5g4qACIiJ+ellCg7rna/8ic3nySVPdh2Lb6HDZnt1/MOy5k6VyezmwJ2 wEuF4W8o2BL1thoApPlhiPa55KNZOoRFhoM4Qa8xjDpYvgb2FJiWw7BlRM0qFHvWNDAwN80O3aL vmsA18/9lyAyaJthBHazyyBUmgu2UDpk15HT+4VDjI8YHUyC1RJML50hzreE+RQQMLTPR16uNvw Oi3qpFb7+GZhoKXESLaTrxSo3vPCsaq415PHHI9GUewK2pwdauFMQCGKMoznadFl+k+9BxHoRb9 gidcjfNslj3Hpvl5PKZ8gFgWqvb+XrTXeFzfKYtpaSCxoRwPouF+kZrSra5UXHZ1GDyODD+aEDJ osohttLjYf45dbsQEHvQHbr4QSiQyd1H7CfvRg4sUv09WdoISkxXN4P0wVdSl+lytJpYRJ4M5m+ 14pD6ZiShR249XcFPc+eN1QY7bfXLMN0ChkiPVbch1YCf3O5ldOIAWBq6tkDwqtk8Brc5cYWwBs 6PKdeOF/mK1ic26I06xlk/1dCCIR9hPHRDlXxTzrt00ZG1twEC0NCVU3t89/XmR4PnKOIqXxk3T wMgsnfnFDYUNEZ+Gr7RvqMCeBRobbiBso9dPQXIP5ienCGn9xQhcHWP2WQW5Ki9alXmvigkWNR5 gYdZJ4jGK0pDdH5b8shZP5r+7DbtoyFtLAJtvPTYDrykKf+UciJ3akaDlDG1oU272a4s66dMa/X CfN0vDsw== X-Received: by 2002:a05:6000:40cd:b0:47f:aebd:841d with SMTP id ffacd0b85a97d-47fb1e896bemr7791441f8f.15.1785333002714; Wed, 29 Jul 2026 06:50:02 -0700 (PDT) Received: from localhost (90-182-112-124.rcp.o2.cz. [90.182.112.124]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47fb6b189fbsm7929583f8f.25.2026.07.29.06.50.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 29 Jul 2026 06:50:02 -0700 (PDT) Date: Wed, 29 Jul 2026 15:50:00 +0200 From: Joshua Crofts To: Jeffin Philip Cc: a.hindborg@kernel.org, leitao@debian.org, linux-kernel@vger.kernel.org, syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com Subject: Re: [PATCH] configfs: fix refcount warning in configfs_get_config_item() Message-ID: <20260729155000.00007e68@gmail.com> In-Reply-To: <20260729095125.96899-1-jeffinphilip14@gmail.com> References: <20260729110018.00005e66@gmail.com> <20260729095125.96899-1-jeffinphilip14@gmail.com> X-Mailer: Claws Mail 4.4.0 (GTK 3.24.51; x86_64-w64-mingw32) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Wed, 29 Jul 2026 15:21:25 +0530 Jeffin Philip wrote: > On Wed, 29 Jul 2026 09:00 +0000 > Joshua Crofts wrote: > > >On Wed, 29 Jul 2026 08:55:05 +0000 > >Joshua Crofts wrote: > > > >> syzbot reported a "refcount_t: addition on 0; use-after-free" warning > >> in configfs_get_config_item(). > >> > >> This occurs when configfs_get_config_item() races with a concurrent > >> teardown (e.g. rmdir). When the target config_item's refcount drops to > >> 0, configfs_get_config_item() calls config_item_get(), which > >> unconditionally increments the refcount via kref_get(), triggering the > >> refcount warning. > >> > >> Fix this by using config_item_get_unless_zero(), which safely returns > >> NULL if the refcount is already 0. > >> Reported-by: syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com > >> Closes: https://syzkaller.appspot.com/bug?extid=35790eb7861f8fc57382 > >> Signed-off-by: Joshua Crofts > >> --- > >> fs/configfs/configfs_internal.h | 2 +- > >> 1 file changed, 1 insertion(+), 1 deletion(-) > >> > >> diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h > >> index acdeea8e2..5448af3a8 100644 > >> --- a/fs/configfs/configfs_internal.h > >> +++ b/fs/configfs/configfs_internal.h > >> @@ -124,7 +124,7 @@ static inline struct config_item *configfs_get_config_item(struct dentry *dentry > >> spin_lock(&dentry->d_lock); > >> if (!d_unhashed(dentry)) { > >> struct configfs_dirent * sd = dentry->d_fsdata; > >> - item = config_item_get(sd->s_element); > >> + item = config_item_get_unless_zero(sd->s_element); > >> } > >> spin_unlock(&dentry->d_lock); > > I tested this solution first on syzbot and well, it errored out. But on testing it on a local > build, it seems to trigger a different warning in configfs_get() regarding atomic count. Could you please > look into it? Yeah, I've no idea why syzbot keeps failing on "FATAL: Kernel too old", especially when testing against upstream. As for the different warning, that's odd, because when I booted the kernel with the patch in QEMU and ran the reproducer nothing happened. Could you please send the warning in it's entirety? -- Kind regards, Joshua Crofts