Vasileios Almpanis f06c2d26d1 configfs: unhash the dentry before dropping the item in rmdir ... configfs_get_config_item() treats a hashed dentry as proof that sd->s_element is a live config_item. configfs_rmdir() breaks that: simple_rmdir() leaves the dentry hashed, the last reference to the item is dropped right after, and the dentry is only unhashed by d_delete() once ->rmdir() has returned. configfs_symlink() resolves its target holding no lock on it, so get_target() can land in that window: BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90 get_target fs/configfs/symlink.c:128 [inline] configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185 Unhash in configfs_remove_dir(), while the item is still guaranteed to be there. A reference obtained just before that stays harmless, as create_link() rechecks CONFIGFS_USET_DROPPING, already set by configfs_detach_prep(). Both configfs_unregister_subsystem() paths d_drop() after detaching, so this only makes rmdir match them. Reported-by: syzbot+6b16e3d085833cbf3e25@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6b16e3d085833cbf3e25 Fixes: 7063fbf226 ("[PATCH] configfs: User-driven configuration filesystem") Cc: stable@vger.kernel.org Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com> Tested-by: Breno Leitao <leitao@debian.org> Reviewed-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260730093435.195441-3-vasilisalmpanis@gmail.com Signed-off-by: Breno Leitao <leitao@debian.org>		2026-09-07 09:15:05 -07:00
..
9p	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
adfs
affs	vfs-7.3-rc1.sync	2026-08-17 14:21:00 -07:00
afs	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
autofs	autofs: drop redundant S_IFDIR from mkdir	2026-07-01 12:48:44 +02:00
befs
bfs	vfs-7.3-rc1.sync	2026-08-17 14:21:00 -07:00
btrfs	for-7.3-rc1-tag	2026-09-05 10:18:21 -07:00
cachefiles	cachefiles,netfs: sunset ondemand mode	2026-08-12 16:24:26 +02:00
ceph	kmalloc_obj conversions for v7.3-rc2	2026-09-05 20:45:18 -07:00
coda	vfs-7.3-rc1.misc	2026-08-17 12:56:12 -07:00
configfs	configfs: unhash the dentry before dropping the item in rmdir	2026-09-07 09:15:05 -07:00
cramfs	fs: add dedicated block device open helpers for filesystems	2026-06-29 10:31:52 +02:00
crypto	fscrypt updates for 7.3	2026-08-17 19:04:16 -07:00
debugfs	debugfs: warn if file creation failed due to uninitialized debugfs	2026-07-18 16:07:22 +02:00
devpts
dlm
ecryptfs	eCryptfs updates for 7.3-rc1	2026-08-21 12:32:01 -07:00
efivarfs	EFI updates for v7.3	2026-08-23 09:24:34 -07:00
erofs	Changes since last update:	2026-08-25 12:27:41 -07:00
exfat	This contains a set of nine exfat fixes covering shared writable mappings,	2026-08-22 08:57:28 -07:00
exportfs
ext2	\n	2026-08-20 12:52:35 -07:00
ext4	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
f2fs	f2fs-for-7.3-rc1	2026-08-28 10:48:48 -07:00
fat	mm.git review status for master..mm-nonmm-stable	2026-08-23 08:07:11 -07:00
fuse	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
gfs2	gfs2 changes	2026-08-17 17:03:34 -07:00
hfs	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
hfsplus	hfs/hfsplus updates for v7.3	2026-08-17 18:14:32 -07:00
hostfs	Remove excl arg to ->create inode_operation	2026-07-31 10:18:30 +02:00
hpfs	vfs-7.3-rc1.misc	2026-08-17 12:56:12 -07:00
hugetlbfs	mm.git review status for mm-hotfixes-stable..mm-stable	2026-08-20 18:17:08 -07:00
iomap	for-7.3/block-20260819	2026-08-20 13:55:16 -07:00
isofs	isofs: Drop support of directory entries straddling blocks	2026-07-29 11:18:57 +02:00
jbd2	ext4: enable scoped NOFS when starting a handle in nojournal mode	2026-07-22 23:47:06 -04:00
jffs2	vfs-7.3-rc1.misc	2026-08-17 12:56:12 -07:00
jfs	vfs-7.3-rc1.misc	2026-08-17 12:56:12 -07:00
kernfs	kernfs: preserve security xattrs without allocating iattrs	2026-09-01 17:11:19 +02:00
lockd	NFS client updates for Linux 7.3	2026-08-26 15:09:21 -07:00
minix	vfs-7.3-rc1.sync	2026-08-17 14:21:00 -07:00
netfs	netfs: Fix folio_queue ENOMEM in writeback by adding a mempool	2026-07-28 15:42:31 +02:00
nfs	mm.git review status for linus..mm-stable	2026-08-27 09:17:06 -07:00
nfs_common	NFS/localio: fix ref leak on nfs_uuid_add_file failure	2026-08-10 09:54:35 -04:00
nfsd	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
nilfs2	nilfs2 updates for v7.3	2026-08-17 18:34:43 -07:00
nls
notify	fsnotify: Fix stale object mask after concurrent mark updates	2026-08-05 11:50:45 +02:00
ntfs	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
ntfs3	Changes for 7.3-rc1	2026-08-20 12:27:02 -07:00
ocfs2	mm.git review status for master..mm-nonmm-stable	2026-08-23 08:07:11 -07:00
omfs	vfs-7.3-rc1.misc	2026-08-17 12:56:12 -07:00
openpromfs
orangefs	Fixes:	2026-08-20 12:36:26 -07:00
overlayfs	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
proc	mm.git review status for linus..mm-stable	2026-08-27 09:17:06 -07:00
pstore
qnx4
qnx6
quota	quota: Don't issue audit messages on quota enforcing	2026-08-21 09:09:54 +02:00
ramfs	mm.git review status for linus..mm-stable	2026-08-27 09:17:06 -07:00
resctrl	fs/resctrl: Inform user space when status buffer overflowed	2026-07-26 21:40:26 -07:00
romfs	vfs-7.3-rc1.super	2026-08-17 13:57:04 -07:00
smb	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
squashfs	squashfs: avoid thundering-herd cache wakeups	2026-08-19 19:55:06 -07:00
sysfs
tests
tracefs	eventfs: Initialize ei->children and ei->list in init_ei()	2026-08-24 16:42:57 -04:00
ubifs	This pull request contains updates for UBI and UBIFS:	2026-08-28 10:59:07 -07:00
udf	\n	2026-08-20 12:52:35 -07:00
ufs	vfs-7.3-rc1.misc	2026-08-17 12:56:12 -07:00
unicode	unicode: Properly reject invalid encoding version strings	2026-07-31 16:33:14 -04:00
vboxsf	Remove excl arg to ->create inode_operation	2026-07-31 10:18:30 +02:00
verity	fsverity: Fix silent truncation in bpf_get_fsverity_digest()	2026-08-04 09:24:23 +02:00
xfs	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
zonefs	zonefs: convert iomap ops to ->iomap_next()	2026-07-31 12:28:50 +02:00
aio.c	mm.git review status for mm-hotfixes-stable..mm-stable	2026-08-20 18:17:08 -07:00
anon_inodes.c
attr.c	fs,fsverity: remove check for fsverity being enabled in setattr_prepare()	2026-07-28 21:25:03 -07:00
backing-file.c	fs: fix user path of nested backing files	2026-08-12 11:36:40 +02:00
bad_inode.c	Remove excl arg to ->create inode_operation	2026-07-31 10:18:30 +02:00
binfmt_elf_fdpic.c	binfmt_elf_fdpic: consume a stashed PT_INTERP substitute	2026-08-03 10:08:46 +02:00
binfmt_elf.c	mm.git review status for mm-hotfixes-stable..mm-stable	2026-08-20 18:17:08 -07:00
binfmt_flat.c
binfmt_misc_bpf.c	binfmt_misc: let a 'B' entry bind its interpreters	2026-08-03 19:15:44 +02:00
binfmt_misc.c	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
binfmt_script.c
bpf_fs_kfuncs.c	vfs-7.3-rc1.kfunc	2026-08-17 11:02:10 -07:00
buffer.c	for-7.3/block-20260819	2026-08-20 13:55:16 -07:00
char_dev.c
compat_binfmt_elf.c
coredump.c	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
d_path.c	fs: add failfs	2026-07-27 17:17:59 +02:00
dax.c	mm.git review status for mm-hotfixes-stable..mm-stable	2026-08-20 18:17:08 -07:00
dcache.c	dcache: keep shrink_dcache_for_umount() making progress on busy roots	2026-07-31 10:46:02 +02:00
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c	vfs-7.3-rc1.misc	2026-08-17 12:56:12 -07:00
exec.c	Miscellaneous futex fixes:	2026-08-22 16:29:20 -07:00
failfs.c	fs: support FD_FAILFS_ROOT in fchdir()	2026-07-27 17:17:59 +02:00
fcntl.c
fhandle.c	fhandle: reject detached mounts in capable_wrt_mount()	2026-07-01 15:26:32 +02:00
file_attr.c
file_table.c
file.c
filesystems.c	fs: fix switch/case indentation in sysfs() syscall	2026-08-12 11:36:40 +02:00
fs_context.c
fs_dirent.c
fs_parser.c
fs_pin.c
fs_struct.c	fs: stop rewriting paths for PF_EXITING | PF_DUMPCORE	2026-06-29 10:54:43 +02:00
fs-writeback.c	for-7.3/block-20260819	2026-08-20 13:55:16 -07:00
fserror.c
fsopen.c
init.c
inode.c	fs: remove stale inode_insert5() kernel-doc parameter	2026-08-12 11:36:40 +02:00
internal.h	vfs-7.3-rc1.super	2026-08-17 13:57:04 -07:00
ioctl.c
Kconfig	vfs-7.3-rc1.efs	2026-08-17 08:55:58 -07:00
Kconfig.binfmt	binfmt_misc: add binfmt_misc_ops bpf struct_ops	2026-08-03 10:08:41 +02:00
kernel_read_file.c	fs: use scoped_with_init_fs() for kernel_read_file_from_path_initns()	2026-06-29 10:44:09 +02:00
libfs.c	fs: Provide way for filesystem to wait for metadata writeback	2026-07-27 16:25:32 +02:00
locks.c
Makefile	vfs-7.3-rc1.failfs	2026-08-17 09:15:52 -07:00
mbcache.c
mnt_idmapping.c
mount.h
mpage.c
namei.c	vfs-7.3-rc1.misc	2026-08-17 12:56:12 -07:00
namespace.c	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
nsfs.c
nullfs.c	vfs-7.3-rc1.misc	2026-08-17 12:56:12 -07:00
open.c	fs: support FD_FAILFS_ROOT in fchroot()	2026-07-27 17:18:00 +02:00
pidfs.c	vfs-7.3-rc1.misc	2026-08-17 12:56:12 -07:00
pipe.c	Summary	2026-08-20 08:46:41 -07:00
pnode.c
pnode.h
posix_acl.c	vfs-7.3-rc1.misc	2026-08-17 12:56:12 -07:00
proc_namespace.c	fs: add real_fs to track task's actual fs_struct	2026-06-29 10:43:45 +02:00
read_write.c
readdir.c
remap_range.c
select.c
seq_file.c	seq_file: rename mangle_path to seq_mangle_path	2026-07-31 10:09:14 +02:00
signalfd.c
splice.c
stack.c
stat.c	fs: annotate inode timestamp accessors	2026-07-31 10:09:11 +02:00
statfs.c
super.c	vfs-7.3-rc1.super	2026-08-17 13:57:04 -07:00
sync.c
sysctls.c
timerfd.c
utimes.c
xattr.c