Re: [PATCH v2] configfs: fix slab-UAF Write in config_item_put

[Ran Hongyun]

Hi Drif,

Thanks for your detailed reply and the new patch. I agree that the
IS_DEADDIR() check is needed when simple_rmdir() fails, and that my
error paths mishandle parent_item and leak target references.

With IS_DEADDIR() added, the patch looks functionally correct. There
is one small point: in the CONFIGFS_USET_DIR path of configfs_rmdir,
S_DEAD is set regardless of whether simple_rmdir() succeeds or fails,
so the subsequent parent_item check appears redundant there. It is
still necessary for the non-CONFIGFS_USET_DIR paths, though.

I have not found a clean way to avoid this redundancy, but it does not
cause any functional issue. It may be the best way to fix the UAF issue
so far.

Thanks,
Ran Hongyun