Re: [PATCH 0/2] configfs: fix use-after-free of symlink target racing with rmdir

[Breno Leitao]

On Thu, 30 Jul 2026 11:30:23 +0200, Vasileios Almpanis wrote:
> syzkaller reported a slab-use-after-free in config_item_get() when
> symlink(2) races with rmdir(2) of the symlink target:
> 
>   BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90
>    configfs_get_config_item fs/configfs/configfs_internal.h:127 [inline]
>    get_target fs/configfs/symlink.c:128 [inline]
>    configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185
> 
> [...]

Applied, thanks!

[1/2] configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
      https://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux.git/commit/?id=1507d5b57e40
[2/2] configfs: unhash the dentry before dropping the item in rmdir
      https://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux.git/commit/?id=2251d0ed97c2

Best regards,
-- 
Breno Leitao <leitao@xxxxxxxxxx>