[PATCH] configfs: fix refcount warning in configfs_get_config_item()

[PATCH] configfs: fix refcount warning in configfs_get_config_item()

[Joshua Crofts]

syzbot reported a "refcount_t: addition on 0; use-after-free" warning
in configfs_get_config_item().

This occurs when configfs_get_config_item() races with a concurrent
teardown (e.g. rmdir). When the target config_item's refcount drops to
0, configfs_get_config_item() calls config_item_get(), which
unconditionally increments the refcount via kref_get(), triggering the
refcount warning.

Fix this by using config_item_get_unless_zero(), which safely returns
NULL if the refcount is already 0.

Reported-by: syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=35790eb7861f8fc57382
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
---
 fs/configfs/configfs_internal.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h
index acdeea8e2..5448af3a8 100644
--- a/fs/configfs/configfs_internal.h
+++ b/fs/configfs/configfs_internal.h
@@ -124,7 +124,7 @@ static inline struct config_item *configfs_get_config_item(struct dentry *dentry
 	spin_lock(&dentry->d_lock);
 	if (!d_unhashed(dentry)) {
 		struct configfs_dirent * sd = dentry->d_fsdata;
-		item = config_item_get(sd->s_element);
+		item = config_item_get_unless_zero(sd->s_element);
 	}
 	spin_unlock(&dentry->d_lock);
 
-- 
2.47.3

Re: [PATCH] configfs: fix refcount warning in configfs_get_config_item()

[Joshua Crofts]

On Wed, 29 Jul 2026 08:55:05 +0000
Joshua Crofts <joshua.crofts1@gmail.com> wrote:

> syzbot reported a "refcount_t: addition on 0; use-after-free" warning
> in configfs_get_config_item().
> 
> This occurs when configfs_get_config_item() races with a concurrent
> teardown (e.g. rmdir). When the target config_item's refcount drops to
> 0, configfs_get_config_item() calls config_item_get(), which
> unconditionally increments the refcount via kref_get(), triggering the
> refcount warning.
> 
> Fix this by using config_item_get_unless_zero(), which safely returns
> NULL if the refcount is already 0.
> 
> Reported-by: syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=35790eb7861f8fc57382
> Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
> ---
>  fs/configfs/configfs_internal.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h
> index acdeea8e2..5448af3a8 100644
> --- a/fs/configfs/configfs_internal.h
> +++ b/fs/configfs/configfs_internal.h
> @@ -124,7 +124,7 @@ static inline struct config_item *configfs_get_config_item(struct dentry *dentry
>  	spin_lock(&dentry->d_lock);
>  	if (!d_unhashed(dentry)) {
>  		struct configfs_dirent * sd = dentry->d_fsdata;
> -		item = config_item_get(sd->s_element);
> +		item = config_item_get_unless_zero(sd->s_element);
>  	}
>  	spin_unlock(&dentry->d_lock);
>  

Forgot to add a Fixes: tag so here it is, will respin if necessary:

Fixes: e9c03af21cc7 ("configfs: calculate the symlink target only once")

-- 
Kind regards,
Joshua Crofts

Re: [PATCH] configfs: fix refcount warning in configfs_get_config_item()

[Jeffin Philip]

On Wed, 29 Jul 2026 09:00 +0000
Joshua Crofts <joshua.crofts1@gmail.com> wrote:

>On Wed, 29 Jul 2026 08:55:05 +0000
>Joshua Crofts <joshua.crofts1@gmail.com> wrote:
>
>> syzbot reported a "refcount_t: addition on 0; use-after-free" warning
>> in configfs_get_config_item().
>> 
>> This occurs when configfs_get_config_item() races with a concurrent
>> teardown (e.g. rmdir). When the target config_item's refcount drops to
>> 0, configfs_get_config_item() calls config_item_get(), which
>> unconditionally increments the refcount via kref_get(), triggering the
>> refcount warning.
>> 
>> Fix this by using config_item_get_unless_zero(), which safely returns
>> NULL if the refcount is already 0.
>> Reported-by: syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=35790eb7861f8fc57382
>> Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
>> ---
>>  fs/configfs/configfs_internal.h | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>> 
>> diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h
>> index acdeea8e2..5448af3a8 100644
>> --- a/fs/configfs/configfs_internal.h
>> +++ b/fs/configfs/configfs_internal.h
>> @@ -124,7 +124,7 @@ static inline struct config_item *configfs_get_config_item(struct dentry *dentry
>>  	spin_lock(&dentry->d_lock);
>>  	if (!d_unhashed(dentry)) {
>>  		struct configfs_dirent * sd = dentry->d_fsdata;
>> -		item = config_item_get(sd->s_element);
>> +		item = config_item_get_unless_zero(sd->s_element);
>>  	}
>>  	spin_unlock(&dentry->d_lock);

I tested this solution first on syzbot and well, it errored out. But on testing it on a local
build, it seems to trigger a different warning in configfs_get() regarding atomic count. Could you please 
look into it?

Thanks,
Jeffin.

Re: [PATCH] configfs: fix refcount warning in configfs_get_config_item()

[Joshua Crofts]

On Wed, 29 Jul 2026 15:21:25 +0530
Jeffin Philip <jeffinphilip14@gmail.com> wrote:

> On Wed, 29 Jul 2026 09:00 +0000
> Joshua Crofts <joshua.crofts1@gmail.com> wrote:
> 
> >On Wed, 29 Jul 2026 08:55:05 +0000
> >Joshua Crofts <joshua.crofts1@gmail.com> wrote:
> >  
> >> syzbot reported a "refcount_t: addition on 0; use-after-free" warning
> >> in configfs_get_config_item().
> >> 
> >> This occurs when configfs_get_config_item() races with a concurrent
> >> teardown (e.g. rmdir). When the target config_item's refcount drops to
> >> 0, configfs_get_config_item() calls config_item_get(), which
> >> unconditionally increments the refcount via kref_get(), triggering the
> >> refcount warning.
> >> 
> >> Fix this by using config_item_get_unless_zero(), which safely returns
> >> NULL if the refcount is already 0.
> >> Reported-by: syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com
> >> Closes: https://syzkaller.appspot.com/bug?extid=35790eb7861f8fc57382
> >> Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
> >> ---
> >>  fs/configfs/configfs_internal.h | 2 +-
> >>  1 file changed, 1 insertion(+), 1 deletion(-)
> >> 
> >> diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h
> >> index acdeea8e2..5448af3a8 100644
> >> --- a/fs/configfs/configfs_internal.h
> >> +++ b/fs/configfs/configfs_internal.h
> >> @@ -124,7 +124,7 @@ static inline struct config_item *configfs_get_config_item(struct dentry *dentry
> >>  	spin_lock(&dentry->d_lock);
> >>  	if (!d_unhashed(dentry)) {
> >>  		struct configfs_dirent * sd = dentry->d_fsdata;
> >> -		item = config_item_get(sd->s_element);
> >> +		item = config_item_get_unless_zero(sd->s_element);
> >>  	}
> >>  	spin_unlock(&dentry->d_lock);  
> 
> I tested this solution first on syzbot and well, it errored out. But on testing it on a local
> build, it seems to trigger a different warning in configfs_get() regarding atomic count. Could you please 
> look into it?

Yeah, I've no idea why syzbot keeps failing on "FATAL: Kernel too old",
especially when testing against upstream. As for the different warning,
that's odd, because when I booted the kernel with the patch in QEMU and
ran the reproducer nothing happened. Could you please send the warning
in it's entirety?

-- 
Kind regards,
Joshua Crofts

Re: [PATCH] configfs: fix refcount warning in configfs_get_config_item()

[Breno Leitao]

On Wed, Jul 29, 2026 at 08:55:05AM +0000, Joshua Crofts wrote:
> syzbot reported a "refcount_t: addition on 0; use-after-free" warning
> in configfs_get_config_item().
> 
> This occurs when configfs_get_config_item() races with a concurrent
> teardown (e.g. rmdir). When the target config_item's refcount drops to
> 0, configfs_get_config_item() calls config_item_get(), which
> unconditionally increments the refcount via kref_get(), triggering the
> refcount warning.

Shouldn't be this the fix we are interested in fixing?

> Fix this by using config_item_get_unless_zero(), which safely returns
> NULL if the refcount is already 0.

This looks like more a workaround than a proper fix, no?

I got the impression that we have a UAF behind this refcount issue, and
this is not being solved by this patch.

Re: [PATCH] configfs: fix refcount warning in configfs_get_config_item()

[Joshua Crofts]

On Wed, 29 Jul 2026 03:06:09 -0700
Breno Leitao <leitao@debian.org> wrote:

> On Wed, Jul 29, 2026 at 08:55:05AM +0000, Joshua Crofts wrote:
> > syzbot reported a "refcount_t: addition on 0; use-after-free" warning
> > in configfs_get_config_item().
> > 
> > This occurs when configfs_get_config_item() races with a concurrent
> > teardown (e.g. rmdir). When the target config_item's refcount drops to
> > 0, configfs_get_config_item() calls config_item_get(), which
> > unconditionally increments the refcount via kref_get(), triggering the
> > refcount warning.  
> 
> Shouldn't be this the fix we are interested in fixing?
> 
> > Fix this by using config_item_get_unless_zero(), which safely returns
> > NULL if the refcount is already 0.  
> 
> This looks like more a workaround than a proper fix, no?
>
> I got the impression that we have a UAF behind this refcount issue, and
> this is not being solved by this patch.

Okay, so my interpretation was that this is a concurrency issue that's
causing the UAF by incrementing a 0 refcount. Isn't this exactly the
reason that config_item_get_unless_zero() was implemented? If the refcount
is 0 then it just returns -ENOENT.

-- 
Kind regards,
Joshua Crofts