[PATCH] erofs: don't reuse a superblock for a mount that passes device=

[PATCH] erofs: don't reuse a superblock for a mount that passes device=

[Zhan Xusheng]

From: Zhan Xusheng <zhanxusheng@xiaomi.com>

superblock_share together with device= is rejected in
erofs_fc_fill_super():

	if (test_opt(&sbi->opt, SUPERBLOCK_SHARE) &&
	    sbi->devs->extra_devices)
		return -EINVAL;

but extra_devices is kept in sbi->devs, not in sbi->opt, and
erofs_sb_share_test_super() compares only the backing inode, the
fsoffset and sbi->opt.  So once the image is mounted with
superblock_share, a second mount with superblock_share,device= matches
that superblock and get_tree_super() reuses it without calling
fill_super() at all.

The same command line therefore either fails with -EINVAL or succeeds
with device= quietly dropped, depending on whether a compatible mount
already exists.

Refuse to match a context that brought device= options, so that it gets
a superblock of its own and fill_super() decides as it does today.

Only the incoming context can be tested: a shared superblock may have
extra_devices set itself, because erofs_scan_devices() fills the device
table from the image when no device= was given.

Fixes: cd4108319bb3 ("erofs: reuse superblock for file-backed mounts")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
 fs/erofs/super.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index 16fa3b853f1b6..bc9ab5a6234a0 100644
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -825,6 +825,13 @@ static int erofs_sb_share_test_super(struct super_block *sb,
 		return 0;
 	if (!sbi->dif0.file || !new_sbi->dif0.file)
 		return 0;
+	/*
+	 * extra_devices is not part of sbi->opt, so the memcmp below cannot
+	 * see device= options.  @sb may have extra_devices set from the
+	 * on-disk device table, so only the incoming context is tested.
+	 */
+	if (new_sbi->devs->extra_devices)
+		return 0;
 	return file_inode(sbi->dif0.file) == file_inode(new_sbi->dif0.file) &&
 	       sbi->dif0.fsoff == new_sbi->dif0.fsoff &&
 	       !memcmp(&sbi->opt, &new_sbi->opt, sizeof(sbi->opt));

base-commit: 1137aa577a35e2684e8046c3e53f920e79c7cc60
-- 
2.43.0

Re: [PATCH] erofs: don't reuse a superblock for a mount that passes device=

[Gao Xiang]

Hi Xusheng,

On Wed, Oct 21, 2026 at 04:38:26PM +0800, Zhan Xusheng wrote:
> From: Zhan Xusheng <zhanxusheng@xiaomi.com>
> 
> superblock_share together with device= is rejected in
> erofs_fc_fill_super():
> 
> 	if (test_opt(&sbi->opt, SUPERBLOCK_SHARE) &&
> 	    sbi->devs->extra_devices)
> 		return -EINVAL;
> 
> but extra_devices is kept in sbi->devs, not in sbi->opt, and
> erofs_sb_share_test_super() compares only the backing inode, the
> fsoffset and sbi->opt.  So once the image is mounted with
> superblock_share, a second mount with superblock_share,device= matches
> that superblock and get_tree_super() reuses it without calling
> fill_super() at all.
> 
> The same command line therefore either fails with -EINVAL or succeeds
> with device= quietly dropped, depending on whether a compatible mount
> already exists.
> 
> Refuse to match a context that brought device= options, so that it gets
> a superblock of its own and fill_super() decides as it does today.
> 
> Only the incoming context can be tested: a shared superblock may have
> extra_devices set itself, because erofs_scan_devices() fills the device
> table from the image when no device= was given.
> 
> Fixes: cd4108319bb3 ("erofs: reuse superblock for file-backed mounts")
> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
> ---
>  fs/erofs/super.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/fs/erofs/super.c b/fs/erofs/super.c
> index 16fa3b853f1b6..bc9ab5a6234a0 100644
> --- a/fs/erofs/super.c
> +++ b/fs/erofs/super.c
> @@ -825,6 +825,13 @@ static int erofs_sb_share_test_super(struct super_block *sb,
>  		return 0;
>  	if (!sbi->dif0.file || !new_sbi->dif0.file)
>  		return 0;
> +	/*
> +	 * extra_devices is not part of sbi->opt, so the memcmp below cannot
> +	 * see device= options.  @sb may have extra_devices set from the
> +	 * on-disk device table, so only the incoming context is tested.
> +	 */
> +	if (new_sbi->devs->extra_devices)
> +		return 0;

Yes, it's indeed an issue, but the comment message here is useless
since erofs_fc_fill_super() doesn't explicitly support `device=`.


>  	return file_inode(sbi->dif0.file) == file_inode(new_sbi->dif0.file) &&
>  	       sbi->dif0.fsoff == new_sbi->dif0.fsoff &&
>  	       !memcmp(&sbi->opt, &new_sbi->opt, sizeof(sbi->opt));

		&& !new_sbi->devs->extra_devices;

I think you should just add a line here.

Could you please send another version as soon as possible so I can
apply.

Thanks,
Gao Xiang

> 
> base-commit: 1137aa577a35e2684e8046c3e53f920e79c7cc60
> -- 
> 2.43.0
> 
> 

[PATCH v2] erofs: don't reuse a superblock for a mount that passes device=

[Zhan Xusheng]

From: Zhan Xusheng <zhanxusheng@xiaomi.com>

superblock_share together with device= is rejected in
erofs_fc_fill_super():

	if (test_opt(&sbi->opt, SUPERBLOCK_SHARE) &&
	    sbi->devs->extra_devices)
		return -EINVAL;

but extra_devices is kept in sbi->devs, not in sbi->opt, and
erofs_sb_share_test_super() compares only the backing inode, the
fsoffset and sbi->opt.  So once the image is mounted with
superblock_share, a second mount with superblock_share,device= matches
that superblock and get_tree_super() reuses it without calling
fill_super() at all.

The same command line therefore either fails with -EINVAL or succeeds
with device= quietly dropped, depending on whether a compatible mount
already exists.

Refuse to match a context that brought device= options, so that it gets
a superblock of its own and fill_super() decides as it does today.

Only the incoming context can be tested: a shared superblock may have
extra_devices set itself, because erofs_scan_devices() fills the device
table from the image when no device= was given.

Fixes: cd4108319bb3 ("erofs: reuse superblock for file-backed mounts")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
v2: fold the check into the return statement and drop the comment
    (Gao Xiang)
v1: https://lore.kernel.org/all/20261021083826.1870937-1-zhanxusheng1024@gmail.com/

 fs/erofs/super.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index 16fa3b853f1b..8ca44b1c0bd1 100644
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -827,7 +827,8 @@ static int erofs_sb_share_test_super(struct super_block *sb,
 		return 0;
 	return file_inode(sbi->dif0.file) == file_inode(new_sbi->dif0.file) &&
 	       sbi->dif0.fsoff == new_sbi->dif0.fsoff &&
-	       !memcmp(&sbi->opt, &new_sbi->opt, sizeof(sbi->opt));
+	       !memcmp(&sbi->opt, &new_sbi->opt, sizeof(sbi->opt)) &&
+	       !new_sbi->devs->extra_devices;
 }
 
 static int erofs_file_get_tree(struct fs_context *fc)

base-commit: 52dceb88082b4c7983d1c8c7de1c181f018055ac
-- 
2.43.0

Re: [PATCH v2] erofs: don't reuse a superblock for a mount that passes device=

[Gao Xiang]

On Mon, Oct 26, 2026 at 05:22:17PM +0800, Zhan Xusheng wrote:
> From: Zhan Xusheng <zhanxusheng@xiaomi.com>
> 
> superblock_share together with device= is rejected in
> erofs_fc_fill_super():
> 
> 	if (test_opt(&sbi->opt, SUPERBLOCK_SHARE) &&
> 	    sbi->devs->extra_devices)
> 		return -EINVAL;
> 
> but extra_devices is kept in sbi->devs, not in sbi->opt, and
> erofs_sb_share_test_super() compares only the backing inode, the
> fsoffset and sbi->opt.  So once the image is mounted with
> superblock_share, a second mount with superblock_share,device= matches
> that superblock and get_tree_super() reuses it without calling
> fill_super() at all.
> 
> The same command line therefore either fails with -EINVAL or succeeds
> with device= quietly dropped, depending on whether a compatible mount
> already exists.
> 
> Refuse to match a context that brought device= options, so that it gets
> a superblock of its own and fill_super() decides as it does today.
> 
> Only the incoming context can be tested: a shared superblock may have
> extra_devices set itself, because erofs_scan_devices() fills the device
> table from the image when no device= was given.
> 
> Fixes: cd4108319bb3 ("erofs: reuse superblock for file-backed mounts")
> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>

Reviewed-by: Gao Xiang <xiang@kernel.org>

Also I will update the subject as "erofs: fix disallowing superblock_share
if device= is set".

Thanks,
Gao Xiang