UPSTREAM: loop: fix concurrent lo_open/lo_release
范龙飞 reports that KASAN can report a use-after-free in __lock_acquire. The reason is due to insufficient serialization in lo_release(), which will continue to use the loop device even after it has decremented the lo_refcnt to zero. In the meantime, another process can come in, open the loop device again as it is being shut down. Confusion ensues. (cherry-picked from ae665016) Change-Id: Iada5ceba515f0137db8c95d0746e8ffc753037f3 Reported-by:范龙飞 <long7573@126.com> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by:
Jens Axboe <axboe@kernel.dk> Signed-off-by:
Marissa Wall <marissaw@google.com>
Loading
Please sign in to comment