kernel/git/stable/linux.git/fs/configfs, branch master

configfs: unhash the dentry before dropping the item in rmdir

2026-09-07T16:15:05+00:00

configfs_get_config_item() treats a hashed dentry as proof that sd->s_element is a live config_item. configfs_rmdir() breaks that: simple_rmdir() leaves the dentry hashed, the last reference to the item is dropped right after, and the dentry is only unhashed by d_delete() once ->rmdir() has returned. configfs_symlink() resolves its target holding no lock on it, so get_target() can land in that window: BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90 get_target fs/configfs/symlink.c:128 [inline] configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185 Unhash in configfs_remove_dir(), while the item is still guaranteed to be there. A reference obtained just before that stays harmless, as create_link() rechecks CONFIGFS_USET_DROPPING, already set by configfs_detach_prep(). Both configfs_unregister_subsystem() paths d_drop() after detaching, so this only makes rmdir match them. Reported-by: syzbot+6b16e3d085833cbf3e25@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6b16e3d085833cbf3e25 Fixes: 7063fbf22611 ("[PATCH] configfs: User-driven configuration filesystem") Cc: stable@vger.kernel.org Signed-off-by: Vasileios Almpanis Tested-by: Breno Leitao Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260730093435.195441-3-vasilisalmpanis@gmail.com Signed-off-by: Breno Leitao

configfs: pin the symlink target's dirent instead of chasing ->ci_dentry

2026-09-07T16:14:59+00:00

create_link() reads the target's configfs_dirent from item->ci_dentry->d_fsdata, relying on the item reference taken by get_target(). That reference pins the item, not its dentry: the dentry is pinned by DCACHE_PERSISTENT, which configfs_remove_dir() releases via simple_rmdir() while the item is still alive. A symlink racing with rmdir of its target can therefore find ->ci_dentry freed and its dirent released, triggering WARN_ON(!atomic_read(&sd->s_count)) in configfs_get(). Take the dirent in get_target() as well, under ->d_lock and atomically with the item reference, and pass it down to create_link(). A hashed dentry has not been killed yet, so its ->d_fsdata reference keeps the dirent alive there. Cc: stable@vger.kernel.org Fixes: 7063fbf22611 ("[PATCH] configfs: User-driven configuration filesystem") Signed-off-by: Vasileios Almpanis Tested-by: Breno Leitao Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260730093435.195441-2-vasilisalmpanis@gmail.com Signed-off-by: Breno Leitao

configfs: move CONFIGFS_MAGIC definition to magic.h

2026-09-02T02:28:55+00:00

IMA shouldn't measure or appraise configfs, but currently does because it's missing from the default exclusion policies. Move CONFIGFS_MAGIC to magic.h to expose the file system's magic to IMA, as well as other userland applications. Suggested-by: Mimi Zohar Signed-off-by: Frederick Lawler Acked-by: Breno Leitao Signed-off-by: Mimi Zohar

Merge tag 'pull-configfs-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-06-14T22:58:20+00:00

Pull configfs updates from Al Viro: "A couple of fixes (UAF in configfs_lookup() and really old races introduced when lseek() on configfs directories stopped locking those directories; impact up to and including UAF). Fixes aside, the main result is that configfs is finally switched to tree-in-dcache machinery. It's *not* making use of recursive removal helpers yet, and it still does the bloody awful "build subtree in full sight of userland, with possibility of failure halfway through and need to unroll" that forces the locking model from hell; dealing with that is a separate patch series, once this one is out of the way. However, it is using DCACHE_PERSISTENT properly now. And apparmorfs is the sole remaining user of __simple_{unlink,rmdir}() at that point" * tag 'pull-configfs-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: create_default_group(): pass parent's dentry instead of config_group configfs_attach_group(): drop the unused parent_item argument configs_attach_item(): drop unused parent_item argument configfs_create(): lift parent timestamp updates into callers kill configfs_drop_dentry() configfs: mark pinned dentries persistent configfs: dentry refcount needs to be pinned only once switch configfs_detach_{group,item}() to passing dentry configfs_remove_dir(), detach_attrs(): switch to passing dentry populate_attrs(): move cleanup to the sole caller populate_group(): move cleanup on failure to the sole caller configfs_detach_rollback(): pass configfs_dirent instead of dentry configfs_do_depend_item(): pass configfs_dirent instead of dentry configfs_depend_prep(): pass configfs_dirent instead of dentry configfs_detach_prep(): pass configfs_dirent instead of dentry configfs_mkdir(): use take_dentry_name_snapshot() configfs: fix lockless traversals of ->s_children configfs_lookup(): don't leave ->s_dentry dangling on failure

Merge tag 'pull-d_add' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-06-14T22:51:00+00:00

Pull dentry d_add() cleanups from Al Viro: "This converts a bunch of unidiomatic uses of d_add() in ->lookup() instances to equivalent uses of d_splice_alias(), which is the normal mechanism for ->lookup()" * tag 'pull-d_add' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: gfs2: use d_splice_alias() for ->lookup() return value ntfs: use d_splice_alias() for ->lookup() return value simple_lookup(): use d_splice_alias() for ->lookup() return value ecryptfs: use d_splice_alias() for ->lookup() return value configfs_lookup(): switch to d_splice_alias() tracefs: use d_splice_alias() in ->lookup() instances

create_default_group(): pass parent's dentry instead of config_group

2026-06-08T18:55:02+00:00

the only way parent_group is used there... Reviewed-by: Jan Kara Signed-off-by: Al Viro

configfs_attach_group(): drop the unused parent_item argument

2026-06-08T18:54:40+00:00

This one *was* used - for passing it to configfs_attach_item(), which didn't use the value passed to it. Reviewed-by: Jan Kara Signed-off-by: Al Viro

configs_attach_item(): drop unused parent_item argument

2026-06-08T18:54:05+00:00

That argument has been unused since the initial merge in 2005. Reviewed-by: Jan Kara Signed-off-by: Al Viro

configfs_create(): lift parent timestamp updates into callers

2026-06-08T18:53:41+00:00

... and do *not* do it in ->lookup() case. stat foo/bar should not update mtime of foo, TYVM... Reviewed-by: Jan Kara Signed-off-by: Al Viro

kill configfs_drop_dentry()

2026-06-08T18:53:14+00:00

Fold into the only remaining user, don't bother with the timestamps of parent - we are going to rmdir it shortly anyway, which will override those. Fix the locking of inode, while we are at it - updating the link count and timestamps ought to be done with the inode locked. Reviewed-by: Jan Kara Signed-off-by: Al Viro