On (26/08/04 13:10), Andrew Morton wrote:
> On Tue,  4 Aug 2026 14:59:17 +0800 Longlong Xia <xialonglong2025@163.com> wrote:
> 
> > Both writeback_store() and read_block_state() derive their table scan
> > bounds from zram->disksize before acquiring dev_lock. If the device is
> > reset and reinitialized with a smaller disksize between that read and lock
> > acquisition, the bound can describe the old table while the scan operates
> > on the new one. This can lead to out-of-bounds slot accesses.
> > 
> > Move both bound calculations under dev_lock so each bound remains
> > consistent with the table throughout its scan. Keep the fixes separate
> > because the affected interfaces originate from different commits and can
> > be backported independently.
> 
> Thanks.  AI review found several things to be worried about, all are
> pre-existing.
> 
> 	https://sashiko.dev/#/patchset/20260804065919.3970386-1-xialonglong2025@163.com

- u32 disksize range check is fixed in a separate Longlong Xia's patch.

- read_block_state() read of zram->disksize outside of device lock
  is fixed in this series.

- read_block_state() tear-down is something to look into.