From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f44.google.com (mail-ej1-f44.google.com [209.85.218.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B0700429003 for ; Wed, 29 Jul 2026 08:55:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785315318; cv=none; b=na1XSP56519I8C/3uP2H7mWcmA14k0C0ORzBAddmzNyAxXn6MZrqdgAwRp7QMkNZYv00v5f7fECnHSfzFrKG4RsNVDMQM51kpG4Q/Iaqe+Nap9xM6eNmJQ8rTgdDznJ9+mS5czaGllDDjRgtpkNZFqYG7R+E6cAA7d/zUDg0064= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785315318; c=relaxed/simple; bh=6QjxGau/C3u4KmD4UyxBVv2f9YSO5S/Fw/ve7CeJGgQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=W69TPteKtFa169bOx6u9gLEqEu4oEsSNLaxaSCJfMUF45nBqJhAM7nGGtzMFw/tgogKHAa/PoXP4LBBx699uO8uiea4OQFhY098+1wUh2VebPE9Trpx/TAolqz3BgcTldyGPYwTkTGROScZCjd8y5GMSwIdFeAJz+RC5txiqO40= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ry6E7f/X; arc=none smtp.client-ip=209.85.218.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ry6E7f/X" Received: by mail-ej1-f44.google.com with SMTP id a640c23a62f3a-c1c4db7ca93so91982666b.2 for ; Wed, 29 Jul 2026 01:55:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785315315; x=1785920115; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=FhfKWsUbbvYguK34erNytG1eSydJZ24BqmWqaycvAQo=; b=ry6E7f/XpA/4W8ayC414GK/hx60NqJ88rDDAhh2uduCnGuifkjgG/udP/PWvrD8kaM pRwqIY6vZydgfDLS63Pw29JejJqfu6kW7gWjC22S8qK+XqpuOPzPSd8ZnKrXAurAqXoo 7XHCk6iIST7lxq6N3PxHUQCEdg9p/69yB4rJOy+VBeBcNmtqYXLHzYdBQ5uCHJJw28Gp RyV5BhSCHxo3LUddhUQm4lb2xz2cwJu3y5QjnJeZYXVCaVfNRJ5/z6AxzIywUkmqhB7w 7v4h74RoNZj3CpZgclJxX9jGIbrVJekt3QamfjHBw5dvsKzZbZeWCJuwusAsIF9AbQqR JToA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785315315; x=1785920115; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=FhfKWsUbbvYguK34erNytG1eSydJZ24BqmWqaycvAQo=; b=njtON6iI1ascDOL0vpHY9YjdK6u9Buri4d6nY25nEmUFX84FYRLMScM/FuXA9BbBxF Vx45S6SVHiLdDIxNxpYICWcHP6LyHRmpYJWDkcqoRZS+lWQ3ubZm4juFb6JI+jNa6Rjg 1SP4KTPGB5Y5QOhzIm9QT9RLmLIbZ7yLmJTYVh8JufkW6j62J0dXmrsUsBVrHLjSWU7z NPGqrSAr9HQehcj0FyxKICEcMD8+q0QSoSlWeNYUDaaL+BIPK8OHBhd+O+Yzgw+QOS+S egxlZ4SXOqaTXofYXAxmfA2KHtcm8JdE9xqz98D+Qg6eBCP940sFbPVRny/EKXIb2rg/ Njug== X-Gm-Message-State: AOJu0Yw26COuTt6D8vDJTF+1yJPUhzv2/5TqOJfFErq8JUk9nCcKrdr8 kGJ9TQ3K9B3CyFS0vWh2WpEAZ70vzuvQhpec/ge4H2PHsxt+IqAnV18n X-Gm-Gg: AR+sD11x7mrWYR+uvNkjLulPMNkloFfHfPAxaALvSU0B4sb1Xpy6ogU0/M+pfL3JvWc 3oHWpEBb6pRpxdKx1rjEYBUYZXISWgVEIryqRCjOl6H8mq+trBUcHfooKS8DT63IiQiEFEiHxlX YapGd6ChkzV2EOdlrXgr0J/Csdd1ZO7d19YciwjJVc1euAsOGCTDjtWSWQwa9D19DbARUBQ2H2o OLFu/iufRCzZsjA0VTHEsgUBe/iBAaHkqWp85lAp/VH5tFGUhU447bAqwPXf4iolRP42eK5p+EK COtOz3/thHdrpHUlubZbXCpM5UscuTvsnBp5C81lTJgao7Rp9Il7xosWJp/TzO0G/M4rjpxmhz2 0js86DSbkvEEmpgl666Pr3bQIWWxFBqyH6ijDTZsYgovI1Q1xQNGvtlEbpUrG9q7mQqIybWFD9g /YqHlwlu15rF4KCyQaAemPfd0EANAeOoQfGpu12tJfupZQukynVdajoTPLNthsYeORD+plFKhSr 5//tibnJuvppC9hoY8SgvDPvBAmv+OirsJTmYwsAxr+HtjT9YmvVbJCLK9KBfSO/rL6wtEJbyWQ uFpsQTnkIkQuWoVMe4aT4uoLF04R4rguEojxVbAEBf3n+IFtquD0mTWirldzb1rt0rfD6kv9hK9 MEMM2fDuVVQYCrr0vqUpYhe9tPzdUVqyRBtTQeHlZSN5PUrYj/7Sc6VCCLPouOfdvtuzyTEV/Ul 8EQSeSHY4vRQuaG/tkLFHK5GcoCksbLBqtz4CUUXE1HB2CjmgZqC9U5kuBVbFr5tmQeC73SKHlP P1VpoVw X-Received: by 2002:a17:907:a04:b0:c16:2d90:68a7 with SMTP id a640c23a62f3a-c1f71e568ffmr302263966b.26.1785315314599; Wed, 29 Jul 2026 01:55:14 -0700 (PDT) Received: from cs-280612103108-default.europe-west4-a.c.oa7bb030819b2a894-tp.internal (200.171.158.34.bc.googleusercontent.com. [34.158.171.200]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c1f83f4de45sm83117766b.35.2026.07.29.01.55.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 29 Jul 2026 01:55:14 -0700 (PDT) From: Joshua Crofts To: Andreas Hindborg , Breno Leitao Cc: linux-kernel@vger.kernel.org, syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com Subject: [PATCH] configfs: fix refcount warning in configfs_get_config_item() Date: Wed, 29 Jul 2026 08:55:05 +0000 Message-ID: <20260729085505.1316-1-joshua.crofts1@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit syzbot reported a "refcount_t: addition on 0; use-after-free" warning in configfs_get_config_item(). This occurs when configfs_get_config_item() races with a concurrent teardown (e.g. rmdir). When the target config_item's refcount drops to 0, configfs_get_config_item() calls config_item_get(), which unconditionally increments the refcount via kref_get(), triggering the refcount warning. Fix this by using config_item_get_unless_zero(), which safely returns NULL if the refcount is already 0. Reported-by: syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=35790eb7861f8fc57382 Signed-off-by: Joshua Crofts --- fs/configfs/configfs_internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h index acdeea8e2..5448af3a8 100644 --- a/fs/configfs/configfs_internal.h +++ b/fs/configfs/configfs_internal.h @@ -124,7 +124,7 @@ static inline struct config_item *configfs_get_config_item(struct dentry *dentry spin_lock(&dentry->d_lock); if (!d_unhashed(dentry)) { struct configfs_dirent * sd = dentry->d_fsdata; - item = config_item_get(sd->s_element); + item = config_item_get_unless_zero(sd->s_element); } spin_unlock(&dentry->d_lock); -- 2.47.3