mirror of
https://github.com/torvalds/linux.git
synced 2026-10-23 23:51:02 +02:00
6b1b324e96
configfs_rmdir() drops the last reference to an item while its dentry is still hashed, so a symlink(2) resolving that target takes a reference on freed memory. syzbot reported it [1]. Race mkdir/rmdir of a target against symlink/unlink of a link to it, watching /sys/kernel/warn_count. Fails until the fix [2] lands. Link: https://syzkaller.appspot.com/bug?extid=6b16e3d085833cbf3e25 [1] Link: https://lore.kernel.org/all/20260730093435.195441-1-vasilisalmpanis@gmail.com/ [2] Link: https://patch.msgid.link/20260826-config_selftest-v1-4-e364b07e91ac@debian.org Signed-off-by: Breno Leitao <leitao@debian.org> |
||
|---|---|---|
| .. | ||
| crypto/chacha20-s390 | ||
| cxl | ||
| fault-injection | ||
| ktest | ||
| kunit | ||
| memblock | ||
| nvdimm | ||
| radix-tree | ||
| rbtree | ||
| scatterlist | ||
| selftests | ||
| shared | ||
| vma | ||
| vsock | ||