Forwarded: [PATCH] Fix UAF in configfs

From: syzbot

Date: Wed Jul 29 2026 - 04:54:20 EST


For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.

***

Subject: [PATCH] Fix UAF in configfs
Author: jeffinphilip14@xxxxxxxxx

#syz test
---
fs/configfs/configfs_internal.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h
index acdeea8e2d69..337e313651e7 100644
--- a/fs/configfs/configfs_internal.h
+++ b/fs/configfs/configfs_internal.h
@@ -124,8 +124,9 @@ static inline struct config_item *configfs_get_config_item(struct dentry *dentry
spin_lock(&dentry->d_lock);
if (!d_unhashed(dentry)) {
struct configfs_dirent * sd = dentry->d_fsdata;
- item = config_item_get(sd->s_element);
+ item = config_item_get_unless_zero(sd->s_element);
}
+
spin_unlock(&dentry->d_lock);

return item;
--
2.55.0