kernel/git/next/linux-next.git/fs, branch stable

configfs: unhash the dentry before dropping the item in rmdir

2026-09-07T16:15:05+00:00

configfs_get_config_item() treats a hashed dentry as proof that sd->s_element is a live config_item. configfs_rmdir() breaks that: simple_rmdir() leaves the dentry hashed, the last reference to the item is dropped right after, and the dentry is only unhashed by d_delete() once ->rmdir() has returned. configfs_symlink() resolves its target holding no lock on it, so get_target() can land in that window: BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90 get_target fs/configfs/symlink.c:128 [inline] configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185 Unhash in configfs_remove_dir(), while the item is still guaranteed to be there. A reference obtained just before that stays harmless, as create_link() rechecks CONFIGFS_USET_DROPPING, already set by configfs_detach_prep(). Both configfs_unregister_subsystem() paths d_drop() after detaching, so this only makes rmdir match them. Reported-by: syzbot+6b16e3d085833cbf3e25@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6b16e3d085833cbf3e25 Fixes: 7063fbf22611 ("[PATCH] configfs: User-driven configuration filesystem") Cc: stable@vger.kernel.org Signed-off-by: Vasileios Almpanis Tested-by: Breno Leitao Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260730093435.195441-3-vasilisalmpanis@gmail.com Signed-off-by: Breno Leitao

configfs: pin the symlink target's dirent instead of chasing ->ci_dentry

2026-09-07T16:14:59+00:00

create_link() reads the target's configfs_dirent from item->ci_dentry->d_fsdata, relying on the item reference taken by get_target(). That reference pins the item, not its dentry: the dentry is pinned by DCACHE_PERSISTENT, which configfs_remove_dir() releases via simple_rmdir() while the item is still alive. A symlink racing with rmdir of its target can therefore find ->ci_dentry freed and its dirent released, triggering WARN_ON(!atomic_read(&sd->s_count)) in configfs_get(). Take the dirent in get_target() as well, under ->d_lock and atomically with the item reference, and pass it down to create_link(). A hashed dentry has not been killed yet, so its ->d_fsdata reference keeps the dirent alive there. Cc: stable@vger.kernel.org Fixes: 7063fbf22611 ("[PATCH] configfs: User-driven configuration filesystem") Signed-off-by: Vasileios Almpanis Tested-by: Breno Leitao Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260730093435.195441-2-vasilisalmpanis@gmail.com Signed-off-by: Breno Leitao

Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2026-09-06T03:45:18+00:00

Pull kmalloc_obj conversions from Kees Cook: "Another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci" * tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: treewide: refresh kmalloc_obj() conversions drm/amd/display: Fix harmless type mismatch in allocation

Merge tag 'driver-core-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

2026-09-05T18:59:05+00:00

Pull driver core fixes from Danilo Krummrich: - Fix kernfs listxattr() not returning security xattr names (e.g. SELinux labels) when the kernfs node has no allocated kernfs_iattrs - Fix silent truncation of IRQ vector indices in the Rust PCI abstractions - Don't select OF from DRIVER_PE_KUNIT_TEST; skip the test when OF is disabled instead of silently enabling extra kernel functionality - Russ Weight is retiring from kernel development; update the Firmware Loader sysfs contact to the driver-core mailing list, add a CREDITS entry for Firmware Upload, and update MAINTAINERS accordingly * tag 'driver-core-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: MAINTAINERS: Remove Russ Weight from Firmware Loader CREDITS: Add CREDITS entry for Firmware Upload firmware_loader: Change contact for sysfs nodes rust: pci: reject IRQ vector indices that do not fit in u32 kernfs: preserve security xattrs without allocating iattrs drivers: base: test: DRIVER_PE_KUNIT_TEST should not select OF

Merge tag 'for-7.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

2026-09-05T17:18:21+00:00

Pull btrfs fixes from David Sterba: - preserve inode compression level when changing attributes - fix lost wakeup when waiting for a zstd workspace - fix bio context leaks after ordered extent processing errors - in send, handle unexpected extents for non-regular inodes - handle edge case in creation of reloc tree with enabled quotas - in scrub report the exact failing offset, not the stripe base - error handling fixes - error code propagation in send, zoned mode and raid-stripe-tree - restore active device pointer after seeding device addition error - transaction abort fixups - update Chris' email address * tag 'for-7.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: MAINTAINERS: update Chris Mason's email address btrfs: tests: do not touch page cache if root/inode allocation failed btrfs: zstd: fix lost wakeup when waiting for a workspace btrfs: do not force reloc root creation during qgroup_account_snapshot() btrfs: send: fix lost error return value in will_overwrite_ref() btrfs: abort transaction before releasing tree_log_mutex on commit failure btrfs: zoned: propagate do_zone_finish() error in btrfs_zone_finish_endio() btrfs: zoned: finish active block group cleanup if call_zone_finish() fails btrfs: send: reject extents for non-regular inodes btrfs: return proper negative error code for update_raid_extent_item() btrfs: fix the possible bioc_list memory leak during error btrfs: fix transaction use-after-free in raid stripe insertion btrfs: scrub: report the failing sector's address, not the stripe base btrfs: preserve the compression property when other inode flags change btrfs: restore active device pointers after failed sprout btrfs: detach failed sprout device from transaction update list btrfs: clean up target device if block group marking fails

treewide: refresh kmalloc_obj() conversions

2026-09-05T04:37:00+00:00

This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook

Merge tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

2026-09-05T02:36:11+00:00

Pull IMA fixes from Mimi Zohar: - Instantiating the ima_file_truncate and ima_path_truncate LSM hooks resulted in configfs locking issues. configfs files should not be measured, appraised, or audited in the first place, so the builtin policies are updated to exclude them. - IMA audit messages include the filename, which could result in a page fault when the filename doesn't exist - Un-hide the IMA_MEASURE_PCR_IDX Kconfig prompt * tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: allow users to specify the pcr index with IMA_MEASURE_PCR_IDX ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() ima: don't measure/appraise files on configfs configfs: move CONFIGFS_MAGIC definition to magic.h

Merge tag 'ceph-for-7.3-rc2' of https://github.com/ceph/ceph-client

2026-09-04T20:27:58+00:00

Pull ceph fixes from Ilya Dryomov: "A small fixup for the new nearfull_sync mount option, a potential use-after-free fix (marked for stable) and a patch that eliminates the last use of PageWriteback macro in the tree" * tag 'ceph-for-7.3-rc2' of https://github.com/ceph/ceph-client: ceph: apply nearfull_sync option on remount libceph: remove pinning assertion in ceph_msg_data_iter_next() ceph: lock mutex in ceph_mds_check_access()

Merge tag 'ksmbd-for-7.3-rc2-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb

2026-09-04T15:42:14+00:00

Pull smb server fixes from Namjae Jeon: - Fix a tree connection use-after-free in smb2_tree_connect() by balancing references across concurrent connect, disconnect, and session logoff paths. - Validate source and target ranges in COPYCHUNK requests before range locking and copy operations. - Fix an oplock break notification UAF by acquiring a connection reference under ksmbd_inode lock and releasing it after the notification work completes. - Fix the sparc build by using an unsigned int for the atomic work state, ensuring xchg() uses a supported four-byte operation. * tag 'ksmbd-for-7.3-rc2-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb: ksmbd: fix tree connection use-after-free in smb2_tree_connect() ksmbd: validate COPYCHUNK source and target ranges ksmbd: fix use-after-free in oplock break notification ksmbd: fix sparc build with atomic work state

Merge tag 'ntfs-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs

2026-09-03T15:10:04+00:00

Pull ntfs fixes from Namjae Jeon: - Serialize truncate, fallocate, and mmap fault paths with invalidate_lock, avoiding mmap failures during concurrent size changes and exposure of uninitialized data during allocation - Correct fallocate signal and zeroing error handling - Fix FITRIM range alignment to prevent discard requests from extending into allocated clusters - Fix free-cluster accounting when cluster-freeing rollback or bitmap clearing fails - Keep volumes marked dirty when ntfs errors have been recorded - Compute bi_sector in 512-byte units, preventing silent corruption on 4Kn devices - Validate sectors_per_cluster values and prevent undefined shifts when parsing MFT and index record sizes - Bound $AttrDef traversal to the loaded table size - Fix MFT record resizing, memmove overlap, and kmap_local cleanup issues - Improve error propagation across attribute, EA, and reparse operations, including returning -ERANGE for undersized xattr buffers - Avoid modifying the HasEA flag when setxattr fails and return DT_UNKNOWN when directory inode lookup fails - Reduce contention in WOF decompression by performing block reads outside the decompression lock * tag 'ntfs-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (23 commits) ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite() ntfs: take invalidate_lock in ntfs_setattr_size() ntfs: handle signal interruption in fallocate ntfs: fix FITRIM range alignment ntfs: read WOF chunks outside the decompression lock ntfs: leave HasEA flag untouched on setxattr failure ntfs: fix race between fallocate and mmap reads ntfs: fix memmove overlap in ntfs_new_attr_flags ntfs: compute bi_sector in 512-byte units ntfs: reject invalid sectors_per_cluster in the boot sector ntfs: bound $AttrDef table walk to the loaded table size ntfs: fix undefined behavior in mft/index record size calculation ntfs: treat any nonzero dio zero-range return as an error ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize ntfs: do not mark the volume clean in sync_fs when errors were recorded ntfs: skip free cluster decrement when rollback fails ntfs: only count successfully cleared runs when freeing clusters ntfs: fix kmap_local leak in write_mft_record_nolock() error paths ntfs: return real error from ntfs_non_resident_attr_record_add() ntfs: preserve error code in ntfs_resident_attr_record_add() ...