Forwarded: [PATCH] configfs: unhash dentry before dropping the item

[syzbot <syzbot+6b16e3d085833cbf3e25@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] configfs: unhash dentry before dropping the item
Author: jchuang26@m.fudan.edu.cn

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git a7c1290eef60711c10289c056ad32ed1f2b47b12

Reported-by: syzbot+6b16e3d085833cbf3e25@syzkaller.appspotmail.com

diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 3c88f13f1..d9c222ff0 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -418,6 +418,16 @@ static void configfs_remove_dir(struct dentry *d)
 			pr_warn("remove_dir (%pd): attributes remain", d);
 	}
 
+	/*
+	 * The dentry can still have external references (e.g. from a
+	 * concurrent configfs_symlink() path lookup), in which case
+	 * simple_rmdir() will not have unhashed it yet.  Make sure the
+	 * dentry is unreachable before the caller drops the last
+	 * reference to the config_item, since configfs_symlink() resolves
+	 * targets by taking a reference through a hashed dentry.
+	 */
+	d_drop(d);
+
 	pr_debug(" o %pd removing done (%d)\n", d, d_count(d));
 
 	dput(parent);