kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity

configfs: Fixes for v7.3-rc2

Browse source 
- A symlink racing with rmdir of its target could reach a freed
   ->ci_dentry. The reference get_target() takes pins the config_item,
   not its dentry; the dentry is pinned by DCACHE_PERSISTENT, which
   configfs_remove_dir() drops while the item is still alive. Take the
   target's configfs_dirent under ->d_lock instead of chasing
   ->ci_dentry.
 
 - configfs_rmdir() left the dentry hashed across the final put of the
   item, and configfs_get_config_item() treats a hashed dentry as proof
   of a live item. A concurrent symlink could therefore resurrect a
   dying item and hit a use-after-free. Unhash in configfs_remove_dir(),
   while the item is still guaranteed to be there.
 
 Both issues were found by syzbot.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEErIU5puj0ZwLKSkObNaOTn/x4d20FAmqe6GQACgkQNaOTn/x4
 d21unBAAqg0vIxjQAGhQ/hZnnqdFJ9es63NE93H4ZZJzkLa9J5xqMnbAVAOUoPwo
 BIbUs4uNVunJdhx3hgiPFSjEB9g+d9xxuoxNLHNPFptQe720QJ5ETC5X/QCmCrUc
 QUOVLFN0EomOXXN7HK8+hKKTbslIFHDN2SmLkICprHwL6YKygginhhHaHGukY8Oo
 Mfro0MTaFaVvQM6137r9EB3pnR+i+mtwEDjyWxBQFH3/KtyPW0RrUiyPM5uBP5ds
 ECr1UsqMNFJfeLDH8T6SQ80hz/dczByo5OHyrMrmdmeQWmZLNEtKS0Q9L7kveS5L
 l5PuAH2f6PHcF+cziflvB1hVy/zFWAZ6aOUMdKJY7HBImMWnWdjhm2p9ssVVe0zy
 GlrXbULTekq7W4o/X70948hnk0jU3auHkeFSTHc6T/u8pt1HmKVV+Bg/uYsj8cFh
 +DSeR5iZwj5LaYQ9mMocZQucjEBjT/Cqy/N2sT2gvKqnbyQ0w1mJEeuXMrU23NsV
 2oRSMcXYEraBw6Ccnq2E7LL97tKwLp4g7myUsUGjcAe6i1JSM8d1X9wDoyL9QaHs
 JTdHzIg0LoDX5hHjc7gBW2/Kj3cm8xvvs+lxjNM8aBIsszKTGVNakjA3IsI5UFax
 /1IhMMKiyhIGJO2APFlfAzViTPm04DuAkFM80zCdH9pRfvcD2DU=
 =kqSj
 -----END PGP SIGNATURE-----

Merge tag 'configfs-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux

Pull configfs fixes from Breno Leitao:

 - A symlink racing with rmdir of its target could reach a freed
   ->ci_dentry.

   The reference that get_target() takes pins the config_item, not
   its dentry; the dentry is pinned by DCACHE_PERSISTENT, which
   configfs_remove_dir() drops while the item is still alive.

   Take the target's configfs_dirent under ->d_lock instead of chasing
   ->ci_dentry.

 - configfs_rmdir() left the dentry hashed across the final put of the
   item, and configfs_get_config_item() treats a hashed dentry as proof
   of a live item. A concurrent symlink could therefore resurrect a
   dying item and hit a use-after-free.

   Unhash in configfs_remove_dir(), while the item is still guaranteed
   to be there.

Both issues were found by syzbot.

* tag 'configfs-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux:
  configfs: unhash the dentry before dropping the item in rmdir
  configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
This commit is contained in:
Linus Torvalds 2026-09-07 10:01:38 -07:00
commit c297ed90fb
2 changed files with 29 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files