Re: [PATCH] jffs2: don't start the GC thread on a read-only superblock

[Zhan Xusheng]

Hi Chaohai,

On Wed, Oct 28, 2026 at 04:09:55PM +0800, Chaohai Chen wrote:
> fspick() builds its fs_context with sb_flags=0 and sb_flags_mask=0,
> which means "leave every superblock flag alone"; JFFS2 misreads that
> as "the filesystem is becoming read-write" and starts jffs2_gcd_mtdX
> although the superblock stays read-only, and reconfigure_super()
> then leaves sb->s_flags untouched.

This is fixed for all filesystems by fa6c71988168 ("super: keep the
read-only state if a reconfiguration doesn't change it") in
vfs-7.5.super, tagged for stable.  With it, the steps from the syzbot
log (read-only mount, fspick(), FSCONFIG_CMD_RECONFIGURE, umount) no
longer start the GC thread; on mainline they hit the use-after-free.

Thanks,
Zhan Xusheng