From: syzbot <syzbot+6b16e3d085833cbf3e25@syzkaller.appspotmail.com>
To: jchuang26@m.fudan.edu.cn, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [fs?] KASAN: slab-use-after-free Write in config_item_get
Date: Sun, 13 Sep 2026 19:03:03 -0700 [thread overview]
Message-ID: <6aa755d7.a211d2ce.1a5198.0289.GAE@google.com> (raw)
In-Reply-To: <6aa74ffd.2cd27cd2.290120.3dbeSMTPIN_ADDED_BROKEN@gmr-mx.google.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Write in config_item_get
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
BUG: KASAN: slab-use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
BUG: KASAN: slab-use-after-free in __refcount_add include/linux/refcount.h:283 [inline]
BUG: KASAN: slab-use-after-free in __refcount_inc include/linux/refcount.h:366 [inline]
BUG: KASAN: slab-use-after-free in refcount_inc include/linux/refcount.h:383 [inline]
BUG: KASAN: slab-use-after-free in kref_get include/linux/kref.h:45 [inline]
BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90 fs/configfs/item.c:104
Write of size 4 at addr ffff88804491f01c by task syz.1.545/7868
CPU: 1 UID: 0 PID: 7868 Comm: syz.1.545 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
__refcount_add include/linux/refcount.h:283 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
kref_get include/linux/kref.h:45 [inline]
config_item_get+0x26/0x90 fs/configfs/item.c:104
get_target fs/configfs/symlink.c:139 [inline]
configfs_symlink+0x407/0x11d0 fs/configfs/symlink.c:200
vfs_symlink+0x18b/0x330 fs/namei.c:5794
filename_symlinkat+0x1cd/0x420 fs/namei.c:5819
__do_sys_symlinkat fs/namei.c:5839 [inline]
__se_sys_symlinkat+0x4e/0x2b0 fs/namei.c:5834
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
Tested on:
commit: a7c1290e configfs: pin the symlink target's dirent ins..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1626c115580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6d794b10c2a1184e
dashboard link: https://syzkaller.appspot.com/bug?extid=6b16e3d085833cbf3e25
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Note: no patches were applied.
next parent reply other threads:[~2026-09-14 2:03 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <6aa74ffd.2cd27cd2.290120.3dbeSMTPIN_ADDED_BROKEN@gmr-mx.google.com>
2026-09-14 2:03 ` syzbot [this message]
[not found] <6aa3ec49.faa14f7e.2f7ba7.7c6fSMTPIN_ADDED_BROKEN@gmr-mx.google.com>
2026-09-11 13:16 ` syzbot
[not found] <6aa3b8a3.df8406c6.e4681.4ae6SMTPIN_ADDED_BROKEN@gmr-mx.google.com>
2026-09-11 8:44 ` syzbot
[not found] <SI2PR03MB564251F6E74EDBC70B1BA6C5C0BF2@SI2PR03MB5642.apcprd03.prod.outlook.com>
2026-09-10 12:47 ` syzbot
2026-07-30 0:19 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6aa755d7.a211d2ce.1a5198.0289.GAE@google.com \
--to=syzbot+6b16e3d085833cbf3e25@syzkaller.appspotmail.com \
--cc=jchuang26@m.fudan.edu.cn \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®