Merge tag 'configfs-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux

Pull configfs fixes from Breno Leitao:

 - A symlink racing with rmdir of its target could reach a freed
   ->ci_dentry.

   The reference that get_target() takes pins the config_item, not
   its dentry; the dentry is pinned by DCACHE_PERSISTENT, which
   configfs_remove_dir() drops while the item is still alive.

   Take the target's configfs_dirent under ->d_lock instead of chasing
   ->ci_dentry.

 - configfs_rmdir() left the dentry hashed across the final put of the
   item, and configfs_get_config_item() treats a hashed dentry as proof
   of a live item. A concurrent symlink could therefore resurrect a
   dying item and hit a use-after-free.

   Unhash in configfs_remove_dir(), while the item is still guaranteed
   to be there.

Both issues were found by syzbot.

* tag 'configfs-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux:
  configfs: unhash the dentry before dropping the item in rmdir
  configfs: pin the symlink target's dirent instead of chasing ->ci_dentry

0 files changed, 0 insertions, 0 deletions