github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-23 23:51:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/configfs: race symlink against rmdir of the target

Browse Source 
configfs_rmdir() drops the last reference to an item while its dentry is
still hashed, so a symlink(2) resolving that target takes a reference on
freed memory.  syzbot reported it [1].

Race mkdir/rmdir of a target against symlink/unlink of a link to it,
watching /sys/kernel/warn_count.

Fails until the fix [2] lands.

Link: https://syzkaller.appspot.com/bug?extid=6b16e3d085833cbf3e25 [1]
Link: https://lore.kernel.org/all/20260730093435.195441-1-vasilisalmpanis@gmail.com/ [2]
Link: https://patch.msgid.link/20260826-config_selftest-v1-4-e364b07e91ac@debian.org
Signed-off-by: Breno Leitao <leitao@debian.org>
This commit is contained in:
Breno Leitao 2026-08-26 03:47:05 -07:00
parent 77b20a890a
commit 6b1b324e96
2 changed files with 63 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
tools/testing/selftests/filesystems/configfs/Makefile
View File

@ -2,7 +2,7 @@
# Copyright (c) 2026 Meta Platforms, Inc. and affiliates
# Copyright (c) 2026 Breno Leitao <leitao@debian.org>
CFLAGS += -Wall -Werror
CFLAGS += -Wall -Werror -pthread
TEST_GEN_PROGS := configfs_test
include ../../lib.mk

62
tools/testing/selftests/filesystems/configfs/configfs_test.c
View File

@ -11,6 +11,7 @@
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
#include <pthread.h>
#include <sched.h>
#include <stdbool.h>
#include <stdio.h>
@ -41,6 +42,8 @@
#define LINK_SRC SYMLINKS "/kselftest-src"
#define LINK LINK_SRC "/kselftest-link"
#define RACE_ITERATIONS 20000
static const char * const test_links[] = {
LINK,
};
@ -405,6 +408,65 @@ TEST_F(configfs, symlink_target_is_an_attribute)
EXPECT_EQ(errno, ENOTDIR);
}
static volatile int race_stop;
static void *rmdir_target(void *arg)
{
while (!race_stop) {
if (mkdir(ITEM_A, 0755) == 0 || errno == EEXIST)
rmdir(ITEM_A);
}
return NULL;
}
/* -1 if the kernel does not export a warning counter. */
static long warn_count(void)
{
char buf[32];
if (read_attr("/sys/kernel/warn_count", buf, sizeof(buf)) < 0)
return -1;
return strtol(buf, NULL, 10);
}
TEST_F(configfs, symlink_races_with_target_rmdir)
{
pthread_t thread;
long warns;
int i;
warns = warn_count();
if (warns < 0)
SKIP(return, "no /sys/kernel/warn_count to watch");
ASSERT_EQ(mkdir(LINK_SRC, 0755), 0);
ASSERT_EQ(pthread_create(&thread, NULL, rmdir_target, NULL), 0);
/*
* configfs_rmdir() drops the last reference to the item while its
* dentry is still hashed, and get_target() takes a hashed dentry as
* proof that the item behind it is alive. The symlink then walks
* ->ci_dentry into a released dirent, which configfs_get() warns
* about. KASAN sees the freed item itself.
*/
for (i = 0; i < RACE_ITERATIONS; i++) {
if (symlink(ITEM_A, LINK) == 0)
unlink(LINK);
/* Give up on the first splat rather than flood the log. */
if (!(i % 128) && warn_count() != warns)
break;
}
race_stop = 1;
ASSERT_EQ(pthread_join(thread, NULL), 0);
EXPECT_EQ(warn_count(), warns)
TH_LOG("kernel warned after %d iterations", i);
}
TEST_F(configfs, module_pinned_by_item)
{
ASSERT_EQ(mkdir(ITEM_A, 0755), 0);