Re: [PATCH] configfs: fix slab-UAF Write in config_item_put

[Ran Hongyun]

Hi Drif,

I hit the same issue and took a look at your patch. I think there is
still a race window in this approach.

> +	parent_item = configfs_get_config_item(dentry->d_parent);
> +	if (!parent_item) {
> +		ret = -ENOENT;
> +		goto out_put_target;
> +	}

configfs_get_config_item() relies on d_unhashed() to decide whether
parent_item is still alive, but the unhash happens in detach_groups()
via d_delete(), which runs *outside* inode_lock():

  configfs_rmdir:
    detach_groups():
      inode_lock(child);
      configfs_detach_group(...);
      inode_unlock(child);          // lock released
      d_delete(child);              // unhash happens here, no lock held
      dput(child);

So between inode_unlock(child) and d_delete(child), the child dentry is
still hashed.  If configfs_symlink() re-acquires the inode lock and calls
configfs_get_config_item() in that window, it gets a non-NULL
parent_item.  rmdir() then proceeds to kfree() the containing object,
and the subsequent allow_link() / config_item_put() still triggers UAF.

A simpler fix would be to check CONFIGFS_USET_DROPPING on the parent
configfs_dirent after re-locking.  I posted such a patch here:

  https://lore.kernel.org/all/20261023091102.1848219-1-ranhongyun1@xxxxxxxxxx/

Thanks,
Ran Hongyun