configfs has had no selftest since day one, which makes maintaining it
harder than it needs to be.
The good news is that it is not hard to test: nearly all of it is
reachable from userspace through mkdir/rmdir/read/write and symlink(2).
This series leverages the sample configfs module to do exactly that.
The sample implements no ->allow_link(), so patch 2 adds a subsystem that
accepts symlinks and patches 3 and 4 build the symlink coverage on it.
Patch 4 races symlink(2) against rmdir(2) of the target and reproduces the
use-after-free syzbot reported, so it fails until these patch land:
1507d5b57e40 ("configfs: pin the symlink target's dirent instead of chasing
->ci_dentry")
2251d0ed97c2 ("configfs: unhash the dentry before dropping the item in rmdir")
Both are in configfs-next. The first trips the s_count WARN_ON()
in configfs_get(), the second the KASAN use-after-free in
config_item_get().
Signed-off-by: Breno Leitao <[email protected]>
---
Breno Leitao (4):
selftests/configfs: add tests for the userspace interface
samples/configfs: add a subsystem that accepts symlinks
selftests/configfs: cover symlink and unlink
selftests/configfs: race symlink against rmdir of the target
MAINTAINERS | 1 +
samples/configfs/configfs_sample.c | 121 ++++++
tools/testing/selftests/Makefile | 1 +
.../selftests/filesystems/configfs/.gitignore | 2 +
.../selftests/filesystems/configfs/Makefile | 8 +
.../testing/selftests/filesystems/configfs/config | 5 +
.../selftests/filesystems/configfs/configfs_test.c | 481 +++++++++++++++++++++
7 files changed, 619 insertions(+)
---
base-commit: a8406e6c0b793ce0788019683837c40855b55995
change-id: 20260826-config_selftest-9d84a5b1ec26
Best regards,
--
Breno Leitao <[email protected]>
