From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f181.google.com (mail-pf1-f181.google.com [209.85.210.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 02F55322749 for ; Tue, 23 Jun 2026 03:38:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782185922; cv=none; b=NCQTdr6nVTx2lXMZbeXXICNYbJGShARG4P7uCdZRrcFzO+mo2729owgDZ95xewE4sfcsVBMOTaXqX9SkWHH7FGtowj4fLRV033F+G0pezrTACdz5d3MEQBJCIY+B4e2M0TMp3X5qx70QVR3tGwl0ZWg4JxK5/CgKDSOYxMkbZaI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782185922; c=relaxed/simple; bh=glfl1MBit8W+QUWTq3X7z4tgn4Cy97aBcJJemO5o3qI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kic4/UIjrhfkifo/+bvjTeBjJ1gGTTrXEkpybQq84gm+tOYRKi1qimt3Et+yEJS5PhbskfpCurGZUwT/FRM7ZNb0/dMHEcaARh+JQ8xrB0jpCH1O+0U+LIaRB0Q6IMQKQSkdfw5f2KyfDIJd5K7q55tIli5MYqCzZxiR0UHyYSo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Vf55bfas; arc=none smtp.client-ip=209.85.210.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Vf55bfas" Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-84594492c26so297827b3a.2 for ; Mon, 22 Jun 2026 20:38:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782185920; x=1782790720; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=O9d78UVCpBJjLWE6ysCdQG0jwN+BvnKqjUMmDtzZo9E=; b=Vf55bfasWIe8hi6FRvTtD0lvIODqdR4xyNoDKa7ofEwIW05F8ABFqTz51ZiPpbW8tt GZW7/3ddRac0WiOmC5oBnAUoQ3++OOEv/Usfz9Azqt5NjdyiDsMYWwB64NMUnyDeo3YQ DM+xqEE9I5XuRB1ojRi9E7GzkPdcnTXhP75UQ6+ORoh8ttHt6DfaRe3U4NKWEJJ8Zpuk 7gWELGehbc2G0s8643cApVDJHdJEcP6c5OlcHeS/cq2oyaJR5T2IgQhbqT+/6tfzaUHX vN/Us0zl5xGZ4pXgexc5tc/X327I7rTNYzhdzKSej6HckYM1oh0vvaoPBL19U4r6VL2C oh5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782185920; x=1782790720; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=O9d78UVCpBJjLWE6ysCdQG0jwN+BvnKqjUMmDtzZo9E=; b=EeRR6XcyA/vKMG7yzLW98no+xIdpoE8j0FnQV1kLTwsYOyheT4iiiXXpA1AqEUmaG3 wknE5daiqfiICvID3SdYHLg3i9V6IZQ524j9nZf3wwy+uJUSIRAWtRsz8Kr0xVzzgkFz b5G9CU1Fsc+uTfhOOKTuocciE4z9xmrWqqtou3iLEXMZQgwwPrm77W97dudax5a1O+yF P9Q8YIeJdmCjLKStFN5m9T5nsUpbMQRnuom9o6NZS+oAPxZtFAML9C0SaPAYh4blwT4i KRtc+fEL168Qse/h84UyqwZs83kil3ntz/19e//+5RnmoAncp5x3BLnAg55/RI5MkDVE hwkg== X-Forwarded-Encrypted: i=1; AFNElJ+uBbrQVNarJLPh5RQ/0rCwl77PCust0WsbZTqhZzHp2V1KNvNFggqAHruT+OH43a/7wJZZXREV2HnbzXY=@vger.kernel.org X-Gm-Message-State: AOJu0YybpHEVV1cvG3ENqpsJL2iLm4bxk+Q5KSv9gGUAywh53/YBwjzm 2x3i0ezuJtqY47voWdl1KazlPARQ3zXzvnnbhy9cYBgy6MtbPlHv6Zlr X-Gm-Gg: AfdE7cnRcc5ko2uu21+tQIpbWPie/xN5QugVzgYHSeKGfHO8pgfRMFx/nDHgvaCZnf7 sl3YyVJzj99E62jFCvoClutcVd161J0ygIPCUUU5L3ojj33YcEa1XbmQzf3SWGojkIVhycXfirF nSrg5ZjoKAxisZ4/wKF2w/0qFX0JHS4TXXOxG7pL1hw3yyNCTbjjQc/7gui3fnq0XADrKWAfOly H8e91Z4TN9NzopNRNmKzFGPQG1bIvP7txENJo3cTizLXm1eSp5rOn5RJz0pDs3+ldZDIawE1Y68 twHTVL3ZYHI4rqP3BduikIof2uvmbUQRHmT77PmB6JmEWBtTA5/ZY6+PXgknKwfsjolrLrEeCRJ 0XNJpwf+x6aR7iNnQVO3tMhGZZnxj+71vvDmLeLJSjdf9xrV59t2bolwI6zVmlzGALHflr9PSF3 exvK3tB63+mjHcG7+cBOGbU7I= X-Received: by 2002:a05:6a00:3d0e:b0:845:4ac9:4289 with SMTP id d2e1a72fcca58-84595235596mr1266683b3a.15.1782185920058; Mon, 22 Jun 2026 20:38:40 -0700 (PDT) Received: from osman.mioffice.cn ([43.224.245.178]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84564e74727sm9042622b3a.39.2026.06.22.20.38.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 22 Jun 2026 20:38:39 -0700 (PDT) From: Zhan Xusheng X-Google-Original-From: Zhan Xusheng To: Gao Xiang Cc: Gao Xiang , Chao Yu , Jianan Huang , linux-erofs@lists.ozlabs.org, linux-kernel@vger.kernel.org, Zhan Xusheng , Zhan Xusheng Subject: Re: erofs: is z_erofs_put_pcluster()'s sbi access in the same UAF window as 1aee05e814d2? Date: Tue, 23 Jun 2026 11:38:33 +0800 Message-ID: <20260623033833.3440803-1-zhanxusheng@xiaomi.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Zhan Xusheng On 2026/6/23, Gao Xiang wrote: > In short, I saw some similar report from LLMs, but I think > erofs_shrinker_unregister() should block this from kfree(sbi) > by design. Right, that's the part I'd missed: erofs_shrinker_unregister() drains sbi->managed_pslots (while (!xa_empty(...)) z_erofs_shrink_scan()) in ->put_super before erofs_sb_free(), so the in-flight pcluster keeps sbi pinned across z_erofs_put_pcluster(). Thanks for the clarification. Zhan Xusheng