Re: erofs: is z_erofs_put_pcluster()'s sbi access in the same UAF window as 1aee05e814d2?

On 2026/6/23 11:38, Zhan Xusheng wrote:
> From: Zhan Xusheng <[email protected]>
> 
> On 2026/6/23, Gao Xiang wrote:
>> In short, I saw some similar report from LLMs, but I think
>> erofs_shrinker_unregister() should block this from kfree(sbi)
>> by design.
> 
> Right, that's the part I'd missed: erofs_shrinker_unregister() drains
> sbi->managed_pslots (while (!xa_empty(...)) z_erofs_shrink_scan()) in
> ->put_super before erofs_sb_free(), so the in-flight pcluster keeps sbi
> pinned across z_erofs_put_pcluster(). Thanks for the clarification.

Yes, that is what I meant, also I found usually LLMs could
miss some details by chance, so IMHO we'd better to check
manually again.

Thanks,
Gao Xiang

> 
>    Zhan Xusheng