[PATCH] configfs: fix slab-use-after-free in configfs_get_config_item()

[Igor Putko <igorpetindev@gmail.com>]

When configfs_symlink() resolves the target via get_target(), it uses
kern_path() which takes a reference on the target's dentry. If a
concurrent rmdir occurs, vfs_rmdir() calls dentry_unhash(). However,
because the dentry's refcount is > 1, dentry_unhash() bails out and
does not actually unhash it.

As a result, when configfs_symlink() subsequently calls
configfs_get_config_item(), it finds the dentry still hashed. It then
calls config_item_get() on sd->s_element. But since the concurrent rmdir
has already proceeded to detach and free the config_item, this leads to
a KASAN slab-use-after-free.

Fix this by taking configfs_dirent_lock inside configfs_get_config_item()
and checking if the CONFIGFS_USET_DROPPING flag is set before taking a
reference on the config_item.

Reported-by: syzbot+6b16e3d085833cbf3e25@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6b16e3d085833cbf3e25
Fixes: 7051a3632669 ("configfs: Infrastructure for configfs items.")
Signed-off-by: Igor Putko <igorpetindev@gmail.com>
---
 fs/configfs/configfs_internal.h | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h
index acdeea8e2..90d6c7515 100644
--- a/fs/configfs/configfs_internal.h
+++ b/fs/configfs/configfs_internal.h
@@ -119,12 +119,23 @@ static inline struct configfs_bin_attribute *to_bin_attr(struct dentry *dentry)
 
 static inline struct config_item *configfs_get_config_item(struct dentry *dentry)
 {
-	struct config_item * item = NULL;
+	struct config_item *item = NULL;
 
 	spin_lock(&dentry->d_lock);
 	if (!d_unhashed(dentry)) {
-		struct configfs_dirent * sd = dentry->d_fsdata;
-		item = config_item_get(sd->s_element);
+		struct configfs_dirent *sd = dentry->d_fsdata;
+
+		if (sd) {
+			/*
+			 * vfs_rmdir() keeps dentry in hash, if d_count > 1.
+			 * Make sure to check the deletion flag while
+			 * holding the lock.
+			 */
+			spin_lock(&configfs_dirent_lock);
+			if (!(sd->s_type & CONFIGFS_USET_DROPPING))
+				item = config_item_get(sd->s_element);
+			spin_unlock(&configfs_dirent_lock);
+		}
 	}
 	spin_unlock(&dentry->d_lock);
 
-- 
2.47.3