Re: [PATCH] configfs: fix refcount warning in configfs_get_config_item()

[Breno Leitao]

On Wed, Jul 29, 2026 at 08:55:05AM +0000, Joshua Crofts wrote:
> syzbot reported a "refcount_t: addition on 0; use-after-free" warning
> in configfs_get_config_item().
> 
> This occurs when configfs_get_config_item() races with a concurrent
> teardown (e.g. rmdir). When the target config_item's refcount drops to
> 0, configfs_get_config_item() calls config_item_get(), which
> unconditionally increments the refcount via kref_get(), triggering the
> refcount warning.

Shouldn't be this the fix we are interested in fixing?

> Fix this by using config_item_get_unless_zero(), which safely returns
> NULL if the refcount is already 0.

This looks like more a workaround than a proper fix, no?

I got the impression that we have a UAF behind this refcount issue, and
this is not being solved by this patch.