Re: [PATCH] configfs: fix NULL dereference in configfs_depend_item_unlocked()

[Breno Leitao]

On Mon, Sep 14, 2026 at 03:14:26PM +0530, pavankumaryalagada@xxxxxxxxx wrote:
> From: Yalagada Pavan Kumar <pavankumaryalagada@xxxxxxxxx>
> 
> configfs_depend_item_unlocked() can dereference a NULL parent when
> the configfs item is still being created.
> 
> The item can be found before it is linked to its parent group,
> so ci_group can still be NULL. Check ci_group before using it
> and return -ENOENT if it is NULL.

The crash itself looks real, but this reads like a fix in the wrong
place.  include/linux/configfs.h already documents the opposite
contract for this API:

 /*
  * These functions can sleep and can alloc with GFP_KERNEL
  * NOTE: These should be called only underneath configfs callbacks.
  * NOTE: First parameter is a caller's subsystem, not target's.
  * WARNING: These cannot be called on newly created item
  *        (in make_group()/make_item() callback)
  */
 int configfs_depend_item_unlocked(struct configfs_subsystem *caller_subsys,
                                   struct config_item *target);

"cannot be called on newly created item" is exactly the case being
patched here. 

If configfs is now going to accept a not-yet-linked item and return
-ENOENT for it, shouldn't that comment be updated in the same patch?

And if the contract is meant to stand, shouldn't the caller stop handing
over an unlinked item instead?

> Fixes: 4bb8548df632 ("usb: gadget: f_tcm: add configfs support")

This tag and the diff do not agree.  4bb8548df632 only touches
Documentation/ABI, drivers/usb/gadget/Kconfig and
drivers/usb/gadget/function/f_tcm.c; it does not add or modify anything
under fs/configfs.

--breno