[PATCH v3] configfs: fix slab-UAF Write in config_item_put

[PATCH v3] configfs: fix slab-UAF Write in config_item_put

[Drif Abdelmalek Mohamed Said]

syzbot reported:
BUG: KASAN: slab-use-after-free in config_item_put+0x26/0x90
           fs/configfs/item.c:149

Call Trace:
...
 config_item_put+0x26/0x90 fs/configfs/item.c:149
 configfs_symlink+0x6be/0x11d0 fs/configfs/symlink.c:225
 vfs_symlink+0x18b/0x330 fs/namei.c:5823
 filename_symlinkat+0x1cd/0x420 fs/namei.c:5848

Allocated by task 5712:
...
 nvmet_ports_make+0xe6/0xf00 drivers/nvme/target/configfs.c:2054
 configfs_mkdir+0x4f6/0x9e0 fs/configfs/dir.c:1369
 vfs_mkdir+0x408/0x620 fs/namei.c:5439
 filename_mkdirat+0x289/0x520 fs/namei.c:5472

Freed by task 5712:
...
 config_item_cleanup fs/configfs/item.c:128 [inline]
 config_item_release+0x13a/0x2d0 fs/configfs/item.c:137
 configfs_rmdir+0x885/0x950 fs/configfs/dir.c:1580
 vfs_rmdir+0x3e9/0x6b0 fs/namei.c:5544
 filename_rmdir+0x292/0x520 fs/namei.c:5601

configfs_symlink() takes a reference on parent_item, drops the directory
inode lock around get_target(), and puts the reference at the end. If a
concurrent rmdir removes the group in that window, and parent_item is a
default group embedded in a larger object (e.g. nvmet_port.subsys_group),
the reference does not keep the containing object alive. The object is
freed, and the final config_item_put(parent_item) hits freed memory.

The syzbot reproducer hits this by racing symlinkat() into
ports/1/subsystems against rmdir of ports/1.

Fix this by not holding parent_item across the unlocked window: put it
before inode_unlock(), and look it up again from dentry->d_parent after
inode_lock(), returning -ENOENT if the lookup fails.

That is not enough on its own. configfs_get_config_item() only fails if
the parent dentry was unhashed, but if simple_rmdir() fails, rmdir skips
d_drop() and the dentry stays hashed even though the directory is already
detached. Default groups are detached through configfs_detach_group(),
which marks children S_DEAD, so also check IS_DEADDIR(dir) after retaking
the lock and return -ENOENT.

Reported-by: syzbot+63336d70e1af377d7388@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=63336d70e1af377d7388
Tested-by: syzbot+63336d70e1af377d7388@syzkaller.appspotmail.com
Signed-off-by: Drif Abdelmalek Mohamed Said <drifabdelmalekmohamedsaid@gmail.com>
---
v3:
  - Removed redundant null assignment to parent_item
  - Simplified commit body to not rely heavily on repro
       explain bug and fix logic
v2: https://lore.kernel.org/all/20261023162906.2938-1-drifabdelmalekmohamedsaid@gmail.com/T/
v1: https://lore.kernel.org/all/20261017123748.4430-1-drifabdelmalekmohamedsaid@gmail.com/T/
 fs/configfs/symlink.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c
index 89178f5d371a..62d13ce5b46a 100644
--- a/fs/configfs/symlink.c
+++ b/fs/configfs/symlink.c
@@ -196,12 +196,26 @@ int configfs_symlink(const struct mnt_idmap *idmap, struct inode *dir,
 	 *
 	 *  AV, a thoroughly annoyed bastard.
 	 */
+
+	/* Put the reference back, retake and check after relocking */
+	config_item_put(parent_item);
 	inode_unlock(dir);
 	ret = get_target(symname, &target_item, &target_sd, dentry->d_sb);
 	inode_lock(dir);
 	if (ret)
 		goto out_put;
 
+	if (IS_DEADDIR(dir)) {
+		ret = -ENOENT;
+		goto out_put_target;
+	}
+
+	parent_item = configfs_get_config_item(dentry->d_parent);
+	if (!parent_item) {
+		ret = -ENOENT;
+		goto out_put_target;
+	}
+
 	if (dentry->d_inode || d_unhashed(dentry))
 		ret = -EEXIST;
 	else
@@ -218,6 +232,7 @@ int configfs_symlink(const struct mnt_idmap *idmap, struct inode *dir,
 						     target_item);
 	}
 
+out_put_target:
 	configfs_put(target_sd);
 	config_item_put(target_item);
 
-- 
2.43.0

Re: [PATCH v3] configfs: fix slab-UAF Write in config_item_put

[Breno Leitao]

On Thu, Nov 05, 2026 at 05:50:54PM +0100, Drif Abdelmalek Mohamed Said wrote:
> ---
> v3:
>   - Removed redundant null assignment to parent_item

It wasn't redundant, see below.

>  
> +	if (IS_DEADDIR(dir)) {
> +		ret = -ENOENT;
> +		goto out_put_target;
> +	}

I am seeing the following when running this version:

	refcount_t: addition on 0; use-after-free.
	WARNING: lib/refcount.c:34 at refcount_warn_saturate+0x76/0xd0, CPU#1: ln/172
	Call Trace:

Can you help me to understand how this was tested?

Thanks,
--breno

Re: [PATCH v3] configfs: fix slab-UAF Write in config_item_put

[DRIF ABDELMALEK MOHAMED SAID]

Hello Breno,
> refcount_t: addition on 0; use-after-free.
>WARNING: lib/refcount.c:34 at refcount_warn_saturate+0x76/0xd0, CPU#1: ln/172

So i think this is caused because i removed the null assignment on
parent_item, so it catches
what parent_item pointed to when refcount was 0 but before the free,
and this is actually my mistake, i sent a syztest with the old
parent_item = NULL after the put,
and that is actually important here, because it protects uaf in
out_put and out_put_target,
so we either move the if (IS_DEADDIR(dir)) check after
configfs_get_config_item and omit
parent_item = NULL on the 1st lock, or we keep it as is.
Should i send v4 or you can apply this directly (if good enough)

Cordially,