From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A2FC84418F0 for ; Thu, 30 Jul 2026 14:20:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785421246; cv=none; b=fGa3geuX+EG+wV3vabVzbxDzvSx20r6Ka+Tp9aZg3CtLGYAVfLlFd30VTLlSbIWZT4QnrJ/4utlXL4sEi9sv0vAyL/rCVcj0CJpSIyfcD3IuFRLXDemybMlRRmqa8zFefk6OmnIqtPcz1S0w+tuXVYFK7tFWSwAtdDKHmgmL27k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785421246; c=relaxed/simple; bh=Xhpz5KjL8W/6/fhQt/jo8XpNRvKThDQtmZb8Pyc/S2k=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=UMNEkDXX21jEsnHv+4ZLMp+1YjJqkKlqgbdHv+F9hpDpwtcTbARRNYy+a1kxEBLvHMMMoCCQspmsbIWMw44+KvOUe2JZDyXR9/JMje5z4HuIXreESfkg3SQ3ceNXQ6JziF/Mg5H5GYepKxJGdMCyRr6NNIoZMptdxtAvgU5QKsk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=QaggquL/; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="QaggquL/" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=IE8M/XZ6aqUyC8Luq318qQ0gnuPBMCRCQ1DlrMhT9uI=; b=QaggquL/dbqBoshMRA18X6hFvj caOvUQnEVL5PgMT7DH1ViklctS8p5L1yuT8RtyXtlxqYvhq8+eZtGI3tHF33xq2nYL0gh9HoLOrV2 HV2yalSyqXtyXBSV+irF1X4jfTBwSmviHA7lQhGXpuLs0aCf2tC5c9Lb29yjgKTxi3TQpXohGWX6I vKMST1Tm6bGQOgap7VqxPoE8Yw4sQXwPQiCvWIKFzThvavw4TyF8qR+qMcOJz+DjImorxT0CQtS/I cTOWO/LxAb0kFJbtn0Jc3C+i8+SjzWRVD+kLyWKKDbAHZeFkqTM7mT6VAA8lHtcZ4s6tKil6C/nlq oRUhLspg==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wpRcn-009Ih5-2I; Thu, 30 Jul 2026 14:20:41 +0000 Date: Thu, 30 Jul 2026 07:20:37 -0700 From: Breno Leitao To: Igor Putko Cc: Andreas Hindborg , linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, syzbot+6b16e3d085833cbf3e25@syzkaller.appspotmail.com Subject: Re: [PATCH] configfs: fix slab-use-after-free in configfs_get_config_item() Message-ID: References: <20260730092502.5913-1-igorpetindev@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260730092502.5913-1-igorpetindev@gmail.com> X-Debian-User: leitao On Thu, Jul 30, 2026 at 12:25:02PM +0300, Igor Putko wrote: > Fix this by taking configfs_dirent_lock inside configfs_get_config_item() > and checking if the CONFIGFS_USET_DROPPING flag is set before taking a > reference on the config_item. How was this tested? With this applied, a plain rmdir of any configfs item oopses, because configfs_rmdir() itself calls this helper on the dentry it is removing, after it has already set CONFIGFS_USET_DROPPING. BUG: kernel NULL pointer dereference, address: 0000000000000040 RIP: 0010:configfs_rmdir+0x23d/0x3a0 Call Trace: vfs_rmdir+0xbb/0x200 __x64_sys_rmdir+0x29/0x90