Re: [PATCH] configfs: protect symlink source callbacks from removal

[Yingjie Wang]

Hi Breno,

Thanks for testing this and for the KASAN report.

My original test raced symlink() against rmdir() of a UVC gadget format
directory. The base kernel hit a NULL pointer dereference in
uvcg_format_allow_link() within 1,000 iterations, while my patch completed
10,000 iterations without a KASAN report.

That test did not cover the nvmet parent-item lifetime issue you found.

After your reply, I also tested Drif's posted v3 with the same UVC reproducer
and KASAN configuration. It triggered a use-after-free in config_item_put(),
followed by a refcount warning.

Adding parent_item = NULL immediately after the early config_item_put() made
the same 10,000-iteration test complete without KASAN reports or refcount
warnings.

These tests used QEMU TCG because the host has no /dev/kvm.

I saw your discussion with Drif about the missing NULL assignment, so I
understand that issue has already been identified.

Please do not apply my current frag_sem patch. I will not send a v2 based on
that change alone.

I have not established whether the corrected parent-item fix also protects
the unregister-group and unregister-subsystem callback paths. Those would
need separate verification.

Thanks,
Yingjie