loop: reintroduce global lock for safe loop_validate_file() traversal
authorTetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Tue, 6 Jul 2021 14:40:34 +0000 (23:40 +0900)
committerJens Axboe <axboe@kernel.dk>
Fri, 23 Jul 2021 16:18:25 +0000 (10:18 -0600)
commit3ce6e1f662a910970880188ea7bfd00542bd3934
treefc2ed8f0a332beb2ece07dee8947808823dfb8cb
parent7054133da39a82c1dc44ce796f13a7cb0d6a0b3c
loop: reintroduce global lock for safe loop_validate_file() traversal

Commit 6cc8e7430801fa23 ("loop: scale loop device by introducing per
device lock") re-opened a race window for NULL pointer dereference at
loop_validate_file() where commit 310ca162d779efee ("block/loop: Use
global lock for ioctl() operation.") has closed.

Although we need to guarantee that other loop devices will not change
during traversal, we can't take remote "struct loop_device"->lo_mutex
inside loop_validate_file() in order to avoid AB-BA deadlock. Therefore,
introduce a global lock dedicated for loop_validate_file() which is
conditionally taken before local "struct loop_device"->lo_mutex is taken.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 6cc8e7430801fa23 ("loop: scale loop device by introducing per device lock")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
drivers/block/loop.c