Linus Torvalds 56bc086358 loop: fix concurrent lo_open/lo_release ...

commit ae6650163c upstream.

范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.
The reason is due to insufficient serialization in lo_release(), which
will continue to use the loop device even after it has decremented the
lo_refcnt to zero.

In the meantime, another process can come in, open the loop device
again as it is being shut down. Confusion ensues.

Reported-by: 范龙飞 <long7573@126.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-02-03 17:05:33 +01:00

..

aoe

aoe: fix crash in page count manipulation

2016-11-12 08:27:07 -07:00

drbd

drbd: Fix kernel_sendmsg() usage - potential NULL deref

2016-11-09 17:08:32 -07:00

mtip32xx

blk-mq: remove ->map_queue

2016-09-15 08:42:03 -06:00

paride

paride: make 'verbose' parameter an 'int' again

2016-03-15 16:55:16 -07:00

rsxx

block: convert to device_add_disk()

2016-06-27 12:26:08 -07:00

xen-blkback

xen/blkback: don't free be structure too early

2017-07-05 14:40:20 +02:00

zram

zram: set physical queue limits to avoid array out of bounds accesses

2017-12-14 09:28:21 +01:00

amiflop.c

…

ataflop.c

…

brd.c

block/mm: make bdev_ops->rw_page() take a bool for read/write

2016-08-07 14:41:02 -06:00

cciss_cmd.h

…

cciss_scsi.c

scsi: Do not set cmd_per_lun to 1 in the host template

2015-05-31 18:06:28 -07:00

cciss_scsi.h

…

cciss.c

block: convert to device_add_disk()

2016-06-27 12:26:08 -07:00

cciss.h

…

cryptoloop.c

block: cryptoloop - Use new skcipher interface

2016-01-27 20:35:43 +08:00

DAC960.c

block: DAC960: print a hex number after a 0x prefix

2016-10-27 18:43:43 -07:00

DAC960.h

…

floppy.c

Revert "floppy: refactor open() flags handling"

2016-08-25 08:56:51 -06:00

hd.c

…

Kconfig

cpqarray: remove it from the kernel

2016-03-14 09:06:01 -06:00

loop.c

loop: fix concurrent lo_open/lo_release

2018-02-03 17:05:33 +01:00

loop.h

block: loop: support DIO & AIO

2015-09-23 11:01:16 -06:00

Makefile

drivers:block: cpqarray clean up

2016-03-15 15:59:47 -07:00

mg_disk.c

mg_disk: fix error path in mg_probe()

2016-06-28 11:01:27 -06:00

nbd.c

nbd: fix use-after-free of rq/bio in the xmit path

2018-01-10 09:29:52 +01:00

null_blk.c

Merge branch 'for-4.9/block-irq' of git://git.kernel.dk/linux-block

2016-10-09 17:29:33 -07:00

osdblk.c

block, drivers: add REQ_OP_FLUSH operation

2016-06-07 13:41:38 -06:00

pktcdvd.c

block: rename bio bi_rw to bi_opf

2016-08-07 14:41:02 -06:00

ps3disk.c

block: convert to device_add_disk()

2016-06-27 12:26:08 -07:00

ps3vram.c

block: convert to device_add_disk()

2016-06-27 12:26:08 -07:00

rbd_types.h

rbd: support for exclusive-lock feature

2016-08-24 23:49:16 +02:00

rbd.c

rbd: set max_segments to USHRT_MAX

2018-01-17 09:38:54 +01:00

skd_main.c

skd: Submit requests to firmware before triggering the doorbell

2017-09-27 14:39:21 +02:00

skd_s1120.h

…

smart1,2.h

…

sunvdc.c

block: convert to device_add_disk()

2016-06-27 12:26:08 -07:00

swim3.c

…

swim_asm.S

…

swim.c

…

sx8.c

sx8: use real time for the command seconds

2015-12-23 08:42:59 -07:00

umem.c

block: rename bio bi_rw to bi_opf

2016-08-07 14:41:02 -06:00

umem.h

…

virtio_blk.c

virtio_blk: fix panic in initialization error path

2017-08-11 08:49:36 -07:00

xen-blkfront.c

xen-blkfront: use a right index when checking requests

2017-08-24 17:12:20 -07:00

xsysace.c

…

z2ram.c

…