loop: fix concurrent lo_open/lo_release
authorLinus Torvalds <torvalds@linux-foundation.org>
Sat, 6 Jan 2018 00:26:00 +0000 (16:26 -0800)
committerJens Axboe <axboe@kernel.dk>
Sat, 6 Jan 2018 16:32:07 +0000 (09:32 -0700)
commitae6650163c66a7eff1acd6eb8b0f752dcfa8eba5
treef581ac94d3f2c1e2059e04c392788b0ad4119ba8
parentcbf3a95924d515c1883aec2322fec277e4726134
loop: fix concurrent lo_open/lo_release

范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.
The reason is due to insufficient serialization in lo_release(), which
will continue to use the loop device even after it has decremented the
lo_refcnt to zero.

In the meantime, another process can come in, open the loop device
again as it is being shut down. Confusion ensues.

Reported-by: 范龙飞 <long7573@126.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
drivers/block/loop.c