From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-99.freemail.mail.aliyun.com (out30-99.freemail.mail.aliyun.com [115.124.30.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78C94378818 for ; Tue, 23 Jun 2026 03:08:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.99 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782184123; cv=none; b=ESk6SDMDDrRARCRXj0ngHNrhnAkeeGOsjJuO3kaEmJMxomK/x+x+sl0U2cBwBz9ffvsg+EUYdFJLpmhM9MVeAToMkmv6C/JfWnBgTuFRwP4LS04lsRHq5IlHSnEF9lSGT8NCbAAjx2tSjBSYAUU6B6Dn+re+S1OK00MOcU7HqGU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782184123; c=relaxed/simple; bh=1LXqeXdqzhn67ZxmpOLDs9QOxyMKvn7mUT6ZSAg8Mrg=; h=Message-ID:Date:MIME-Version:Subject:From:To:Cc:References: In-Reply-To:Content-Type; b=Uf6Cl24ezL0HrT27UkDb3XPKzZioO2w+uOsR+KSdb9lOk5wPTYNdltKQYMoOu4blCtd4aJ8DQEoxhKwvoJGtlGizUMBHM9n+qSGjY8//F5PLadaFN4XUjRxuYqVlXYBE2AC7ymPwNEPp4O0NTb+zAuyAIHoTnVRJZPYohJL1yxY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=G0oZGIVe; arc=none smtp.client-ip=115.124.30.99 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="G0oZGIVe" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1782184110; h=Message-ID:Date:MIME-Version:Subject:From:To:Content-Type; bh=zHiDri9KzHNlCTTPg63+52RFsjBrh001hiLblpMgP9A=; b=G0oZGIVeja6p3kFu9Kl3fQsGcZkle8zwpHmP+8cvQpPfKwbO+4aeuRaxSms/CztfaXtKnAMOMfmlCP3xlp1BP4jHCroiYHijoIe/z/Ia3diTv+d5BbSPOJrUxHR098UzdoOp9nEuW26P6Bxyl0GwBuaDc6Jb2bubZbNY4XKOZnI= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R741e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam011083073210;MF=hsiangkao@linux.alibaba.com;NM=1;PH=DS;RN=7;SR=0;TI=SMTPD_---0X5SX67O_1782184109; Received: from 30.221.132.85(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0X5SX67O_1782184109 cluster:ay36) by smtp.aliyun-inc.com; Tue, 23 Jun 2026 11:08:29 +0800 Message-ID: Date: Tue, 23 Jun 2026 11:08:28 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: erofs: is z_erofs_put_pcluster()'s sbi access in the same UAF window as 1aee05e814d2? From: Gao Xiang To: Zhan Xusheng Cc: Gao Xiang , Chao Yu , Jianan Huang , linux-erofs@lists.ozlabs.org, linux-kernel@vger.kernel.org, Zhan Xusheng References: <20260623024946.3420476-1-zhanxusheng@xiaomi.com> <0e2df016-dc1a-4dc5-8461-5a778f029247@linux.alibaba.com> In-Reply-To: <0e2df016-dc1a-4dc5-8461-5a778f029247@linux.alibaba.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit On 2026/6/23 10:52, Gao Xiang wrote: > > > On 2026/6/23 10:49, Zhan Xusheng wrote: >> From: Zhan Xusheng >> >> Hi Xiang, >> >> Following the race model established by commit 1aee05e814d2 ("erofs: fix >> use-after-free on sbi->sync_decompress") -- i.e. unmount does not drain >> the async decompress kworker, and unlocking the output folios lets inode >> eviction (truncate_inode_pages waits on the locked folios) and thus the >> unmount path proceed to kfree(sbi) -- I'd like to ask about another sbi >> access that also happens after the unlock, in the same kworker. >> >> In z_erofs_decompress_pcluster(): >> >>     erofs_onlinefolio_end(page_folio(page), err, true);  /* unlock */ >>     ... >>     z_erofs_put_pcluster(sbi, pcl, try_free); >> >> and in z_erofs_put_pcluster(): >> >>     if (try_free && xa_trylock(&sbi->managed_pslots)) { >>         free = __erofs_try_to_release_pcluster(sbi, pcl); >>         xa_unlock(&sbi->managed_pslots); >>     } >> >> So in the try_free path it dereferences sbi->managed_pslots after the >> output folios have been unlocked, which on control-flow alone looks >> similar to the UAF fixed by 1aee05e814d2. >> >> What makes me unsure, though, is a difference from the sync_decompress >> case: sync_decompress is just a plain sbi member, whereas here >> z_erofs_put_pcluster() is still operating on a live pcluster that is >> registered in sbi->managed_pslots / the managed cache. So it's not clear >> to me whether the pcluster / managed-cache lifetime rules implicitly pin >> the filesystem instance and keep sbi valid across this window. >> >> This also seems much harder to hit than the sync_decompress case: it is >> conditional (try_free, i.e. non-managed compressed pages, plus the >> pcluster refcount reaching zero), the window between the unlock and >> put_pcluster is narrow, and unmount still has evict_inodes/put_super work >> to do before kfree(sbi) -- which may be why syzbot didn't reach it. >> >> Is there any guarantee that sbi stays valid here after the output folios >> are unlocked (e.g. via pcluster / managed-cache lifetime or RCU), or >> could unmount race with this path similarly to 1aee05e814d2? I'm asking >> rather than sending a patch since I couldn't convince myself either way. > > No, this is totally false-positive. In short, I saw some similar report from LLMs, but I think erofs_shrinker_unregister() should block this from kfree(sbi) by design. Thanks, Gao Xiang > >> >> Thanks, >>    Zhan Xusheng >