From nobody Tue Jun 16 06:10:49 2026 Received: from mail-qt1-f174.google.com (mail-qt1-f174.google.com [209.85.160.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 09A533E314C for ; Thu, 16 Apr 2026 15:06:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776351966; cv=none; b=rvmeSREHNjYSJwZayWiyMBRExCHu07X36HxkUkBMWt7BATVyjVd9cbIjTO2SZWHj/4gpYRfF1Ka9AQSpy4vSRMUvlAdvKpx08pOosT1Ykl2asz78mG01LnGdLCM6zc54hBH4ubhfVkIxY+RFdSwnl0QYSUUMOrS6ZBfJCXTPoZ8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776351966; c=relaxed/simple; bh=Al1F9LxdwQPYH1d+6OVlctXzpz8oQZ3GDQFoDUgKM5U=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=kUXHztCSj7QSku7upuaqYZdNMQWR+lco15GwnL4Hy+0bPFUXHA/IVmZjLXbAVHKwK4N1XN5Ne4IIyGAn2EsTdgr0XjS9KiPoJLdkXyEkrmlXevTUGz/46lS9J7bgIQOJf+LhWyHjmKOqujeoWBu/0SSZciAzCykEEY7LLMe/HVg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=u.northwestern.edu; spf=pass smtp.mailfrom=u.northwestern.edu; dkim=pass (2048-bit key) header.d=u-northwestern-edu.20251104.gappssmtp.com header.i=@u-northwestern-edu.20251104.gappssmtp.com header.b=Qijt9nub; arc=none smtp.client-ip=209.85.160.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=u.northwestern.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=u.northwestern.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=u-northwestern-edu.20251104.gappssmtp.com header.i=@u-northwestern-edu.20251104.gappssmtp.com header.b="Qijt9nub" Received: by mail-qt1-f174.google.com with SMTP id d75a77b69052e-50d880e6fbbso7870101cf.0 for ; Thu, 16 Apr 2026 08:06:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=u-northwestern-edu.20251104.gappssmtp.com; s=20251104; t=1776351963; x=1776956763; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=+r7pKm0Oa2J37AR0FDSLuD1gUcrwE8bT/2He5bq2wC4=; b=Qijt9nubWsMQ3ACDh6KarbEc7Sx4XQ5AbOu2TroLG5TY0pUlZHIkQ28lJOuiXbYjCz 5AObOlKcyTbgudKOiYyUfPjfirvejJl49GXUCrjblmpIkroC0/pxvEmkuyb5LNmdiQPI HZOqhvxuiu/R25Q1lMywWLbPpw1lLQ4PTpSnLFGzVmJe/m6JJja7ilo1xhwpHgfw33Zf E0X9Yq8nWj4cx736TczXc+VmrZf+bTc2wgptDMyqHZ6vRhj+FK6lKz/dzLErD992NiqH 4933YI7QvGJtlcVvIGOzVrtzyn3DQVC9QSN8k57i5xGnkiVsS9dApVLdiTLJ+ppjDhmD d7AQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776351963; x=1776956763; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=+r7pKm0Oa2J37AR0FDSLuD1gUcrwE8bT/2He5bq2wC4=; b=LDcLO8OJzRB2bSLSMfei43N8SDR/lXyhZ7buQ5Jg34DiCekrlYPRMPa+tqBePPMHoV GSSrPqYE99CYkBaRZNyRVI4n0WQH5FXA7GGu2ADeYK36DWJJY9dt6Nx5qx5CnaN3hfzj ucWdgn+mOkMLfImgrmkIcBCibl0Mdf+u86t6iEand0TiOLYdl/VBlIFlhcwezcizPIus KPhntqIQZUAaZcQdo1svN6w2X95BTkI/andsqfjzfLqCkjUu8DR2+VVBpQcRHlD2PWpJ IIxaGGMxfhkLa7p8vWYKItgXczssBJQkeaDLx2pFPCVqOIAeYnhqvI4iNK71CCYj8TGx fRrA== X-Forwarded-Encrypted: i=1; AFNElJ9pmTwpzEyRPvuyLuc6eR8GIrAbWXyKnnpKyiBnWU+RuF53WRrg40y10VQRSCtwhAPvrQ9YIpyLmtWEtrc=@vger.kernel.org X-Gm-Message-State: AOJu0Yysagxm3jNq+8GOgdhdfSqVArfmyCheghTxoT1J2I+OZm45+QA6 s9Fkzq/I0mKWRoNL8bv+6fRYNEuyu3g6dyKgNdVZ4E/lURujSydcoB/TnVsU7sqlLOc= X-Gm-Gg: AeBDies92n+96eUZXz4KQWsTgrfaJf+T5S8sLhOTY2lEX/xBMWRMIiSWtByxe4pnb3a 03BqNXCQtA6IpTsFT1yrWoCS1kxDG1t7YEhyTiuSErtgx7wS1XQtopPRmNfGQUJ/YHsE9GUyPCu dUIONsGObGNtZ2C2Hl6knwVRftF+NGtF9efDm/Lx8ZGnDe+MxEhqFVxeaMYIiiDF737osnO5GD5 JuOnUA7eUuN2atRELvowBY9VsuTC08y37TgVnFxmso3E5ZuE8rpaPmYaQYv1yMHlzLkOKDyG+NF ALcRHvFxTYnNXsezkO1UM7rbxWfm5L/3VaZdjbJpjj5ELaai6yBAf1LOw41pHnXwcx1IYGZrF+0 fUD4ZR3ayxZlHm2rA0JjLzhOx9AJcDQrWiyhO7xY7/cC2JKA1RVlIC5zzTxLWzQfsbFf+TdgoIA iT2qlZ/uXQMgr/tAcWOH/9yF7tHZPar9LD0Jfr90SdYWDLvanc03gSR7QVo90X9lXz33r8+1XK8 FbMv0wxCKJC7U4ayYKhhLE= X-Received: by 2002:ac8:5ac5:0:b0:50e:32cd:52fa with SMTP id d75a77b69052e-50e32cd53c0mr2194101cf.3.1776351962785; Thu, 16 Apr 2026 08:06:02 -0700 (PDT) Received: from conor-Inspiron-3020-S.mynetworksettings.com ([2600:4040:44b8:3600:d171:db71:e260:ff8d]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-50e1afc1629sm51124321cf.23.2026.04.16.08.06.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Apr 2026 08:06:02 -0700 (PDT) From: Conor Kotwasinski To: Greg Kroah-Hartman , "Rafael J . Wysocki" , Danilo Krummrich Cc: driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, linux-bluetooth@vger.kernel.org, Conor Kotwasinski , syzbot+d1db96f72a452dc9cbd2@syzkaller.appspotmail.com, syzbot+faeac5b54ba997a96278@syzkaller.appspotmail.com Subject: [PATCH] sysfs: return -ENOENT from move/rename when kobj->sd is NULL Date: Thu, 16 Apr 2026 11:06:00 -0400 Message-ID: <20260416150600.2148935-1-conorkotwasinski2024@u.northwestern.edu> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" sysfs_move_dir_ns() and sysfs_rename_dir_ns() pass kobj->sd to kernfs_rename_ns() unconditionally. If sysfs_remove_dir() has already cleared kobj->sd, the NULL flows through and kernfs_rename_ns() dereferences it via rcu_access_pointer(kn->__parent), which KASAN surfaces as a stack-segment fault on the shadow lookup: Oops: stack segment: 0000 [#1] SMP KASAN PTI RIP: 0010:kernfs_rename_ns+0x3a/0x7a0 fs/kernfs/dir.c:1752 Call Trace: kobject_move+0x525/0x6e0 lib/kobject.c:569 device_move+0xe0/0x730 drivers/base/core.c:4606 hci_conn_del_sysfs+0xb8/0x1a0 net/bluetooth/hci_sysfs.c:75 hci_conn_cleanup net/bluetooth/hci_conn.c:173 [inline] hci_conn_del+0xc36/0x1240 net/bluetooth/hci_conn.c:1234 hci_conn_hash_flush+0x191/0x260 net/bluetooth/hci_conn.c:2638 hci_dev_close_sync+0x821/0x1100 net/bluetooth/hci_sync.c:5327 hci_dev_do_close net/bluetooth/hci_core.c:501 [inline] hci_unregister_dev+0x21a/0x5b0 net/bluetooth/hci_core.c:2715 syzbot has reported 35 hits with this signature across net, net-next and linux-next between July 2025 and January 2026, via both vhci release and HCIDEVRESET ioctl. Return -ENOENT in that case, consistent with sysfs_create_dir_ns(). The underlying ordering problem in bluetooth -- device_move() called after the target's sysfs has been torn down -- is a separate issue. Reported-by: syzbot+d1db96f72a452dc9cbd2@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/687c6966.a70a0220.693ce.00a5.GAE@google= .com/ Reported-by: syzbot+faeac5b54ba997a96278@syzkaller.appspotmail.com Signed-off-by: Conor Kotwasinski --- fs/sysfs/dir.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c index ffdcd4153c58..6664fae288c9 100644 --- a/fs/sysfs/dir.c +++ b/fs/sysfs/dir.c @@ -108,6 +108,9 @@ int sysfs_rename_dir_ns(struct kobject *kobj, const cha= r *new_name, struct kernfs_node *parent; int ret; =20 + if (!kobj->sd) + return -ENOENT; + parent =3D kernfs_get_parent(kobj->sd); ret =3D kernfs_rename_ns(kobj->sd, parent, new_name, new_ns); kernfs_put(parent); @@ -120,6 +123,9 @@ int sysfs_move_dir_ns(struct kobject *kobj, struct kobj= ect *new_parent_kobj, struct kernfs_node *kn =3D kobj->sd; struct kernfs_node *new_parent; =20 + if (!kn) + return -ENOENT; + new_parent =3D new_parent_kobj && new_parent_kobj->sd ? new_parent_kobj->sd : sysfs_root_kn; =20 --=20 2.53.0