Re: [PATCH] configfs: fix refcount warning in configfs_get_config_item()

[Joshua Crofts <joshua.crofts1@gmail.com>]

On Wed, 29 Jul 2026 03:06:09 -0700
Breno Leitao <leitao@debian.org> wrote:

> On Wed, Jul 29, 2026 at 08:55:05AM +0000, Joshua Crofts wrote:
> > syzbot reported a "refcount_t: addition on 0; use-after-free" warning
> > in configfs_get_config_item().
> > 
> > This occurs when configfs_get_config_item() races with a concurrent
> > teardown (e.g. rmdir). When the target config_item's refcount drops to
> > 0, configfs_get_config_item() calls config_item_get(), which
> > unconditionally increments the refcount via kref_get(), triggering the
> > refcount warning.  
> 
> Shouldn't be this the fix we are interested in fixing?
> 
> > Fix this by using config_item_get_unless_zero(), which safely returns
> > NULL if the refcount is already 0.  
> 
> This looks like more a workaround than a proper fix, no?
>
> I got the impression that we have a UAF behind this refcount issue, and
> this is not being solved by this patch.

Okay, so my interpretation was that this is a concurrency issue that's
causing the UAF by incrementing a 0 refcount. Isn't this exactly the
reason that config_item_get_unless_zero() was implemented? If the refcount
is 0 then it just returns -ENOENT.

-- 
Kind regards,
Joshua Crofts