On Tue,  4 Aug 2026 14:59:17 +0800 Longlong Xia <xialonglong2025@163.com> wrote:

> Both writeback_store() and read_block_state() derive their table scan
> bounds from zram->disksize before acquiring dev_lock. If the device is
> reset and reinitialized with a smaller disksize between that read and lock
> acquisition, the bound can describe the old table while the scan operates
> on the new one. This can lead to out-of-bounds slot accesses.
> 
> Move both bound calculations under dev_lock so each bound remains
> consistent with the table throughout its scan. Keep the fixes separate
> because the affected interfaces originate from different commits and can
> be backported independently.

Thanks.  AI review found several things to be worried about, all are
pre-existing.

	https://sashiko.dev/#/patchset/20260804065919.3970386-1-xialonglong2025@163.com