[PATCH] configfs: fix refcount warning in configfs_get_config_item()

[Joshua Crofts]

syzbot reported a "refcount_t: addition on 0; use-after-free" warning
in configfs_get_config_item().

This occurs when configfs_get_config_item() races with a concurrent
teardown (e.g. rmdir). When the target config_item's refcount drops to
0, configfs_get_config_item() calls config_item_get(), which
unconditionally increments the refcount via kref_get(), triggering the
refcount warning.

Fix this by using config_item_get_unless_zero(), which safely returns
NULL if the refcount is already 0.

Reported-by: syzbot+35790eb7861f8fc57382@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=35790eb7861f8fc57382
Signed-off-by: Joshua Crofts <joshua.crofts1@xxxxxxxxx>
---
 fs/configfs/configfs_internal.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h
index acdeea8e2..5448af3a8 100644
--- a/fs/configfs/configfs_internal.h
+++ b/fs/configfs/configfs_internal.h
@@ -124,7 +124,7 @@ static inline struct config_item *configfs_get_config_item(struct dentry *dentry
 	spin_lock(&dentry->d_lock);
 	if (!d_unhashed(dentry)) {
 		struct configfs_dirent * sd = dentry->d_fsdata;
-		item = config_item_get(sd->s_element);
+		item = config_item_get_unless_zero(sd->s_element);
 	}
 	spin_unlock(&dentry->d_lock);
 
-- 
2.47.3