[GIT PULL] configfs: Fixes for 7.3

[Breno Leitao]

Linus,

Please consider pulling these configfs fixes for 7.3-rc3.

These are configfs fixes for two racing issues that were detected by
syszbot and finally addressed.

Thanks,
--breno

PS: This is my first pull request, please let me know if I am not
following any rule.

----------------------------------------------------------------
The following changes since commit df2908090cda368b01ff43709f51890076c56157:

  Linux 7.3-rc2 (2026-09-06 15:07:20 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux.git tags/configfs-7.3-rc3

for you to fetch changes up to f06c2d26d1999d37e93299db0ecead04ca7d0b9f:

  configfs: unhash the dentry before dropping the item in rmdir (2026-09-07 09:15:05 -0700)

Tag SHA: d396bc8e8fb0f7b6517e733816450896c1894813
HEAD SHA: f06c2d26d1999d37e93299db0ecead04ca7d0b9f

----------------------------------------------------------------
configfs: Fixes for v7.3-rc2

- A symlink racing with rmdir of its target could reach a freed
  ->ci_dentry. The reference get_target() takes pins the config_item,
  not its dentry; the dentry is pinned by DCACHE_PERSISTENT, which
  configfs_remove_dir() drops while the item is still alive. Take the
  target's configfs_dirent under ->d_lock instead of chasing
  ->ci_dentry.

- configfs_rmdir() left the dentry hashed across the final put of the
  item, and configfs_get_config_item() treats a hashed dentry as proof
  of a live item. A concurrent symlink could therefore resurrect a
  dying item and hit a use-after-free. Unhash in configfs_remove_dir(),
  while the item is still guaranteed to be there.

Both issues were found by syzbot.

----------------------------------------------------------------
Vasileios Almpanis (2):
      configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
      configfs: unhash the dentry before dropping the item in rmdir

 fs/configfs/dir.c     |  9 +++++++++
 fs/configfs/symlink.c | 24 ++++++++++++++++++++----
 2 files changed, 29 insertions(+), 4 deletions(-)