]> git.baikalelectronics.ru Git - kernel.git/commit
loop: fix concurrent lo_open/lo_release
authorLinus Torvalds <torvalds@linux-foundation.org>
Sat, 6 Jan 2018 00:26:00 +0000 (16:26 -0800)
committerJens Axboe <axboe@kernel.dk>
Sat, 6 Jan 2018 16:32:07 +0000 (09:32 -0700)
commit422ace4c3ab63dca20ebd51fb37d610399ec9721
treef581ac94d3f2c1e2059e04c392788b0ad4119ba8
parentb70a3d20c72a476f46ca3547c980d96f84b0a091
loop: fix concurrent lo_open/lo_release

范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.
The reason is due to insufficient serialization in lo_release(), which
will continue to use the loop device even after it has decremented the
lo_refcnt to zero.

In the meantime, another process can come in, open the loop device
again as it is being shut down. Confusion ensues.

Reported-by: 范龙飞 <long7573@126.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
drivers/block/loop.c