From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-111.freemail.mail.aliyun.com (out30-111.freemail.mail.aliyun.com [115.124.30.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C80434AB01 for ; Tue, 23 Jun 2026 02:52:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.111 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782183174; cv=none; b=t/55wvTJaxO/vdlrGDyRp1VyZLzBslOJrHSnsjEe19eaa8Pb0Seg+LNVhrD6gsjZjtm85EQ33yvSmGruoWu2uwnydxUfGMNoAztD2OJ+UF/S7rCuBKy455e9eRPJnKQjDVXmYhzogt21dsMpJj0jttp7LC/wffCF6Brjc9pZNgI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782183174; c=relaxed/simple; bh=t8HCqQvdlJonA8bUQN4+Ei/eThD08K0NJM18uPhDdQo=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=R1FOCStncjn5cV2KS0de/6bFOw7wLM3WPi/DWW3bcPBXWB/oKuNgPQJBhpTsq4rPT+7Yu8JEi+0ms5s2ohDernM3pVDIUnlt2Ic3khjdHqI6sZf4VrK9J0gIW5tdfnFxK1IZE5DqZFIB+nIifH3W30a0HFITSODFu1X2iklcZug= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=Csjph4x/; arc=none smtp.client-ip=115.124.30.111 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="Csjph4x/" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1782183162; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=R/lOLE+r2XE/sSINR6Cj61K9HooeubIu3bU4meTa6cw=; b=Csjph4x/w3PsMobl0wI5b1L1KT+26YCRY+avzHavAC3OULK6f8HLLGOWYVvWN1JxmD7NwF/KazwO3NkQiueRt6QEugCMuD6unmsI02MHUQMV90CaijlZWVknKO5pI7o1xBSxbeEtooqiA9WaKLSBGQvrHrcCpNF4X6kKYQj9nSE= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R111e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033045133197;MF=hsiangkao@linux.alibaba.com;NM=1;PH=DS;RN=7;SR=0;TI=SMTPD_---0X5SS8yb_1782183161; Received: from 30.221.132.85(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0X5SS8yb_1782183161 cluster:ay36) by smtp.aliyun-inc.com; Tue, 23 Jun 2026 10:52:41 +0800 Message-ID: <0e2df016-dc1a-4dc5-8461-5a778f029247@linux.alibaba.com> Date: Tue, 23 Jun 2026 10:52:40 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: erofs: is z_erofs_put_pcluster()'s sbi access in the same UAF window as 1aee05e814d2? To: Zhan Xusheng Cc: Gao Xiang , Chao Yu , Jianan Huang , linux-erofs@lists.ozlabs.org, linux-kernel@vger.kernel.org, Zhan Xusheng References: <20260623024946.3420476-1-zhanxusheng@xiaomi.com> From: Gao Xiang In-Reply-To: <20260623024946.3420476-1-zhanxusheng@xiaomi.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 2026/6/23 10:49, Zhan Xusheng wrote: > From: Zhan Xusheng > > Hi Xiang, > > Following the race model established by commit 1aee05e814d2 ("erofs: fix > use-after-free on sbi->sync_decompress") -- i.e. unmount does not drain > the async decompress kworker, and unlocking the output folios lets inode > eviction (truncate_inode_pages waits on the locked folios) and thus the > unmount path proceed to kfree(sbi) -- I'd like to ask about another sbi > access that also happens after the unlock, in the same kworker. > > In z_erofs_decompress_pcluster(): > > erofs_onlinefolio_end(page_folio(page), err, true); /* unlock */ > ... > z_erofs_put_pcluster(sbi, pcl, try_free); > > and in z_erofs_put_pcluster(): > > if (try_free && xa_trylock(&sbi->managed_pslots)) { > free = __erofs_try_to_release_pcluster(sbi, pcl); > xa_unlock(&sbi->managed_pslots); > } > > So in the try_free path it dereferences sbi->managed_pslots after the > output folios have been unlocked, which on control-flow alone looks > similar to the UAF fixed by 1aee05e814d2. > > What makes me unsure, though, is a difference from the sync_decompress > case: sync_decompress is just a plain sbi member, whereas here > z_erofs_put_pcluster() is still operating on a live pcluster that is > registered in sbi->managed_pslots / the managed cache. So it's not clear > to me whether the pcluster / managed-cache lifetime rules implicitly pin > the filesystem instance and keep sbi valid across this window. > > This also seems much harder to hit than the sync_decompress case: it is > conditional (try_free, i.e. non-managed compressed pages, plus the > pcluster refcount reaching zero), the window between the unlock and > put_pcluster is narrow, and unmount still has evict_inodes/put_super work > to do before kfree(sbi) -- which may be why syzbot didn't reach it. > > Is there any guarantee that sbi stays valid here after the output folios > are unlocked (e.g. via pcluster / managed-cache lifetime or RCU), or > could unmount race with this path similarly to 1aee05e814d2? I'm asking > rather than sending a patch since I couldn't convince myself either way. No, this is totally false-positive. > > Thanks, > Zhan Xusheng