Re: erofs: is z_erofs_put_pcluster()'s sbi access in the same UAF window as 1aee05e814d2?

Zhan Xusheng <[email protected]> Tue, 23 Jun 2026 11:38:33 +0800

Newsgroups	org.ozlabs.lists.linux-erofs,org.kernel.vger.linux-kernel
Message-ID	<[email protected]>

From: Zhan Xusheng <[email protected]>

On 2026/6/23, Gao Xiang wrote:
> In short, I saw some similar report from LLMs, but I think
> erofs_shrinker_unregister() should block this from kfree(sbi)
> by design.

Right, that's the part I'd missed: erofs_shrinker_unregister() drains
sbi->managed_pslots (while (!xa_empty(...)) z_erofs_shrink_scan()) in
->put_super before erofs_sb_free(), so the in-flight pcluster keeps sbi
pinned across z_erofs_put_pcluster(). Thanks for the clarification.

  Zhan Xusheng