Re: [syzbot] kernel BUG in create_default_group...
From: Edward Adam Davis
Date: Wed Oct 21 2026 - 01:31:23 EST
From: Edward Aadm Davis <eadavis@xxxxxxxx>
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 58161ead29e5
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index eda80c2a2d38..45a955b8ab36 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -313,7 +313,6 @@ static int configfs_create_dir(struct config_item *item, struct dentry *dentry,
goto out_remove;
inode->i_op = &configfs_dir_inode_operations;
- inode->i_fop = &configfs_dir_operations;
/* directory inodes start off with i_nlink == 2 (for "." entry) */
inc_nlink(inode);
d_make_persistent(dentry, inode);
@@ -930,6 +929,10 @@ static int configfs_attach_group(struct config_item *item,
inode_unlock(d_inode(dentry));
if (ret)
d_delete(dentry);
+ else {
+ struct inode *inode = d_inode(dentry);
+ inode->i_fop = &configfs_dir_operations;
+ }
}
return ret;
@@ -1430,8 +1433,13 @@ static struct dentry *configfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
if (group)
ret = configfs_attach_group(item, dentry, frag);
- else
+ else {
ret = configfs_attach_item(item, dentry, frag);
+ if (!ret) {
+ struct inode *inode = d_inode(dentry);
+ inode->i_fop = &configfs_dir_operations;
+ }
+ }
spin_lock(&configfs_dirent_lock);
sd->s_type &= ~CONFIGFS_USET_IN_MKDIR;