mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Zhan Xusheng <zhanxusheng1024@gmail.com>
To: wdhh6@aliyun.com
Cc: syzbot+49c659b5564b2a44083c@syzkaller.appspotmail.com,
	dwmw2@infradead.org, richard@nod.at,
	linux-mtd@lists.infradead.org, syzkaller-bugs@googlegroups.com,
	brauner@kernel.org, linux-fsdevel@vger.kernel.org,
	linux-kernel@vger.kernel.org, zhanxusheng@xiaomi.com
Subject: Re: [PATCH] jffs2: don't start the GC thread on a read-only superblock
Date: Thu, 29 Oct 2026 11:37:56 +0800	[thread overview]
Message-ID: <20261029033756.3959915-1-zhanxusheng1024@gmail.com> (raw)
In-Reply-To: <20261028080955.290774-1-wdhh6@aliyun.com>

Hi Chaohai,

On Wed, Oct 28, 2026 at 04:09:55PM +0800, Chaohai Chen wrote:
> fspick() builds its fs_context with sb_flags=0 and sb_flags_mask=0,
> which means "leave every superblock flag alone"; JFFS2 misreads that
> as "the filesystem is becoming read-write" and starts jffs2_gcd_mtdX
> although the superblock stays read-only, and reconfigure_super()
> then leaves sb->s_flags untouched.

This is fixed for all filesystems by fa6c71988168 ("super: keep the
read-only state if a reconfiguration doesn't change it") in
vfs-7.5.super, tagged for stable.  With it, the steps from the syzbot
log (read-only mount, fspick(), FSCONFIG_CMD_RECONFIGURE, umount) no
longer start the GC thread; on mainline they hit the use-after-free.

Thanks,
Zhan Xusheng

      reply	other threads:[~2026-10-29  3:38 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-27  1:34 [syzbot] [jffs2?] KASAN: slab-use-after-free Read in jffs2_erase_pending_blocks (2) syzbot
2026-10-28  8:09 ` [PATCH] jffs2: don't start the GC thread on a read-only superblock Chaohai Chen
2026-10-29  3:37   ` Zhan Xusheng [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261029033756.3959915-1-zhanxusheng1024@gmail.com \
    --to=zhanxusheng1024@gmail.com \
    --cc=brauner@kernel.org \
    --cc=dwmw2@infradead.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mtd@lists.infradead.org \
    --cc=richard@nod.at \
    --cc=syzbot+49c659b5564b2a44083c@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=wdhh6@aliyun.com \
    --cc=zhanxusheng@xiaomi.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®