From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=61.135.153.170 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792563956; b=CR+FHCrU3zwhhpVKqrWmMgboMO+nzgRoM9U+uD22QCLrhIK/xJJFOxpyDHucEZi7Lz1g MasRbz+g4eMkxJ/vh3J4Z7gpdP8dTdkRCUQlcIHnAyRdAeNw1LeBP4lIhnsxK8vi75kyH VWt54Q8liz9CjbLH2aF5pgXE7wNSGS65WHaxO+IjnYGrAFHYWp5kjjtBELLLvKXsXR6wk UUwbmnuEpGCsOW1T6ddIoLeIeFQQPbtK3I7MIU+ngdChOvsc0XnfcgWu+ET2YGtysAa6W CO8Kp3Kn7aindDX+WVqz9qXewyJ/ThI44Oe1PIQ6DF4WAxaphpYG3AQyTKS4jUf7tJQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792563956; h=DMARC-Filter:DKIM-Signature:X-SMAIL-HELO:Received:X-Sender:X-Auth-ID: X-SMAIL-MID:X-SMAIL-UIID:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=AjRcfuMGPK19o0nfdE5mLK1fdDuDVIRTEqP1pEoISiU=; b=4QA3YrY0DubcIhgHAHx09WF2+qYGaCuJSDrH37fNSGSf42gytanoElP/cmjJhljoTpQt Ewh4hffnDzqJ0ype/eHPyLicWThd6KYsm+eMINHwPxblU0IeWZ3Z+zjYwCMsZKMHwb+Aa bCrBNWr0dOe6rZZY2Ywa4YFxaWp4A+UMePNNIsgnE2OZz2hXfnbFSrV3Y/MIjic+ZYe7A ZykVsaxc87jdjZcaIrFy9tAh2vRbjIuXewQFoxQ+UwVdjAj3aRipp9MG64aAVGVeAeL3m U9rLIAGAiYsUB+IjGFi+AsSxgdyLLPpnNvjtQ8qWMFeC0pk0SXBwsVA09+u8qgf36zQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=sina.com; spf=pass smtp.mailfrom=sina.com; dkim=pass header.d=sina.com header.i=@sina.com header.a=rsa-sha256 header.s=201208 header.b=Pkm2zQtO; arc=none smtp.remote-ip=61.135.153.170 Received: from smtp153-170.sina.com.cn (smtp153-170.sina.com.cn [61.135.153.170]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3F05F606A31B for ; Wed, 21 Oct 2026 06:25:50 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 3F05F606A31B Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sina.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=sina.com header.i=@sina.com header.a=rsa-sha256 header.s=201208 header.b=Pkm2zQtO DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sina.com; s=201208; t=1792563951; bh=AjRcfuMGPK19o0nfdE5mLK1fdDuDVIRTEqP1pEoISiU=; h=From:Subject:Date:Message-ID; b=Pkm2zQtO0nw3kI6To5WPlRdiE05fu2bhUHJ+5HQBBtwldU1M5KpAT5tmMror/GaDj EztJn2+6v8XUdqk038zpj1mB3jbEO+KFFrixJ9RmN76fp8vkUIA3noGx/MUO8UtAKg jFxV6+cJQk9A50ca88m+VfCYUYo3veIbBsmHkcO4= X-SMAIL-HELO: lxu-ped-host.. Received: from unknown (HELO lxu-ped-host..)([111.198.231.89]) by sina.com (10.54.253.34) with ESMTP id 6AD85ADF00003697; Wed, 21 Oct 2026 14:25:40 +0800 (CST) X-Sender: eadavis@sina.com X-Auth-ID: eadavis@sina.com Authentication-Results: sina.com; spf=none smtp.mailfrom=eadavis@sina.com; dkim=none header.i=none; dmarc=none action=none header.from=eadavis@sina.com X-SMAIL-MID: 5868706291678 X-SMAIL-UIID: 71D4861D3FE741D792EA1D58F61D31C4-20261021-142540-1 From: Edward Adam Davis To: syzbot+4fae162886e497f72228@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, leitao@debian.org, a.hindborg@kernel.org Subject: [PATCH] configfs: Delay the fop setting to prevent noise generated by open Date: Wed, 21 Oct 2026 14:25:35 +0800 Message-ID: <20261021062535.55494-1-eadavis@sina.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <6ad65cac.5a04d468.191e0a.001c.GAE@google.com> References: <6ad65cac.5a04d468.191e0a.001c.GAE@google.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit mkdir() triggers: configfs_mkdir() -> configfs_attach_group() -> populate_groups() -> create_default_group("ana_groups") -> configfs_attach_group() -> populate_groups() -> create_default_group("1") The creation of an inode for the subdentry 1 under ana_groups failed due to fault injection. [1] Because helper threads are racing open() on ana_groups, ana_groups has dentry refcount > 1. d_delete() skips dentry_unlink_inode(), leaving d_inode non-NULL. create_default_group() hits BUG_ON(d_inode(child)) at fs/configfs/dir.c:734! [2] [1] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times -1 Call Trace: should_failslab+0xa8/0x100 kmem_cache_alloc_noprof+0xa1/0x600 security_inode_alloc+0x39/0x310 inode_init_always_gfp+0x97e/0xd30 alloc_inode+0x82/0x1b0 new_inode+0x1f/0x170 configfs_new_inode+0x27/0x410 configfs_create+0xb5/0x270 configfs_attach_item+0x25f/0xd60 configfs_attach_group+0x2a/0x370 create_default_group+0x87/0x180 configfs_attach_group+0x169/0x370 configfs_mkdir+0x6f0/0x9e0 vfs_mkdir+0x40c/0x620 [2] kernel BUG at fs/configfs/dir.c:734! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:create_default_group+0x17c/0x180 Call Trace: configfs_attach_group+0x169/0x370 configfs_mkdir+0x6f0/0x9e0 vfs_mkdir+0x40c/0x620 The root cause is a race condition between open and mkdir; delaying the assignment of the fop ensures that directories are not opened before they are ready. Fixes: 7063fbf22611 ("[PATCH] configfs: User-driven configuration filesystem") Reported-by: syzbot+4fae162886e497f72228@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4fae162886e497f72228 Signed-off-by: Edward Adam Davis --- fs/configfs/dir.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c index eda80c2a2d38..45a955b8ab36 100644 --- a/fs/configfs/dir.c +++ b/fs/configfs/dir.c @@ -313,7 +313,6 @@ static int configfs_create_dir(struct config_item *item, struct dentry *dentry, goto out_remove; inode->i_op = &configfs_dir_inode_operations; - inode->i_fop = &configfs_dir_operations; /* directory inodes start off with i_nlink == 2 (for "." entry) */ inc_nlink(inode); d_make_persistent(dentry, inode); @@ -930,6 +929,10 @@ static int configfs_attach_group(struct config_item *item, inode_unlock(d_inode(dentry)); if (ret) d_delete(dentry); + else { + struct inode *inode = d_inode(dentry); + inode->i_fop = &configfs_dir_operations; + } } return ret; @@ -1430,8 +1433,13 @@ static struct dentry *configfs_mkdir(struct mnt_idmap *idmap, struct inode *dir, if (group) ret = configfs_attach_group(item, dentry, frag); - else + else { ret = configfs_attach_item(item, dentry, frag); + if (!ret) { + struct inode *inode = d_inode(dentry); + inode->i_fop = &configfs_dir_operations; + } + } spin_lock(&configfs_dirent_lock); sd->s_type &= ~CONFIGFS_USET_IN_MKDIR; -- 2.43.0