Re: [PATCH] configfs: fix slab-use-after-free in configfs_get_config_item()

[Breno Leitao]

On Thu, Jul 30, 2026 at 12:25:02PM +0300, Igor Putko wrote:
> Fix this by taking configfs_dirent_lock inside configfs_get_config_item()
> and checking if the CONFIGFS_USET_DROPPING flag is set before taking a
> reference on the config_item.

How was this tested? 

With this applied, a plain rmdir of any configfs item oopses, because
configfs_rmdir() itself calls this helper on the dentry it is removing,
after it has already set CONFIGFS_USET_DROPPING.

	BUG: kernel NULL pointer dereference, address: 0000000000000040
	RIP: 0010:configfs_rmdir+0x23d/0x3a0
	Call Trace:
	vfs_rmdir+0xbb/0x200
	__x64_sys_rmdir+0x29/0x90