Linus Torvalds b392225467 loop: fix concurrent lo_open/lo_release ...

commit ae6650163c upstream.

范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.
The reason is due to insufficient serialization in lo_release(), which
will continue to use the loop device even after it has decremented the
lo_refcnt to zero.

In the meantime, another process can come in, open the loop device
again as it is being shut down. Confusion ensues.

Reported-by: 范龙飞 <long7573@126.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-02-03 17:04:24 +01:00

..

aoe

Revert "block: remove artifical max_hw_sectors cap"

2015-08-18 13:21:13 -07:00

drbd

drbd: avoid redefinition of BITS_PER_PAGE

2017-05-08 07:46:01 +02:00

mtip32xx

mtip32xx: Cleanup queued requests after surprise removal

2016-04-12 09:08:52 -07:00

paride

paride: make 'verbose' parameter an 'int' again

2016-05-04 14:48:51 -07:00

rsxx

block: change ->make_request_fn() and users to return a queue cookie

2015-11-07 10:40:46 -07:00

xen-blkback

xen-blkback: don't leak stack data via response ring

2017-11-21 09:21:17 +01:00

zram

zram: set physical queue limits to avoid array out of bounds accesses

2017-12-16 10:33:53 +01:00

amiflop.c

block: drop owner assignment from platform_drivers

2014-10-20 16:20:18 +02:00

ataflop.c

Merge branch 'for-3.16/core' of git://git.kernel.dk/linux-block into next

2014-06-02 09:29:34 -07:00

brd.c

brd: Fix discard request processing

2016-04-12 09:08:53 -07:00

cciss_cmd.h

cciss: use new doorbell-bit-5 reset method

2011-05-06 08:23:55 -06:00

cciss_scsi.c

scsi: Do not set cmd_per_lun to 1 in the host template

2015-05-31 18:06:28 -07:00

cciss_scsi.h

cciss: add cciss_tape_cmds module paramter

2011-05-06 08:23:59 -06:00

cciss.c

cciss: correct the non-resettable board list

2015-05-31 11:14:34 -07:00

cciss.h

cciss: Adds simple mode functionality

2011-08-08 11:40:15 +02:00

cpqarray.c

genirq: Remove the deprecated 'IRQF_DISABLED' request_irq() flag entirely

2015-03-05 20:53:06 +01:00

cpqarray.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

cryptoloop.c

move linux/loop.h to drivers/block

2013-06-29 12:46:45 +04:00

DAC960.c

block: use pci_zalloc_consistent

2014-08-08 15:57:28 -07:00

DAC960.h

Fix DAC960 driver on machines which don't support 64-bit DMA

2007-09-11 17:21:19 -07:00

floppy.c

block: add a bi_error field to struct bio

2015-07-29 08:55:15 -06:00

hd.c

block: hd: remove deprecated IRQF_DISABLED

2014-10-01 08:16:07 -06:00

ida_cmd.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

ida_ioctl.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

Kconfig

nvme: move to a new drivers/nvme/host directory

2015-10-09 10:40:37 -06:00

loop.c

loop: fix concurrent lo_open/lo_release

2018-02-03 17:04:24 +01:00

loop.h

block: loop: support DIO & AIO

2015-09-23 11:01:16 -06:00

Makefile

nvme: move to a new drivers/nvme/host directory

2015-10-09 10:40:37 -06:00

mg_disk.c

block: drop owner assignment from platform_drivers

2014-10-20 16:20:18 +02:00

nbd.c

nbd: ratelimit error msgs after socket close

2016-05-11 11:21:10 +02:00

null_blk.c

null_blk: use async queue restart helper

2015-12-28 13:07:09 -07:00

osdblk.c

mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd

2015-11-06 17:50:42 -08:00

pktcdvd.c

Merge branch 'for-4.4/io-poll' of git://git.kernel.dk/linux-block

2015-11-10 17:23:49 -08:00

ps3disk.c

block: Kill bio_segments()/bi_vcnt usage

2013-11-23 22:33:51 -08:00

ps3vram.c

block: change ->make_request_fn() and users to return a queue cookie

2015-11-07 10:40:46 -07:00

rbd_types.h

rbd: get rid of RBD_MAX_SEG_NAME_LEN

2012-12-17 08:37:29 -06:00

rbd.c

rbd: set max_segments to USHRT_MAX

2018-01-17 09:35:30 +01:00

skd_main.c

skd: Submit requests to firmware before triggering the doorbell

2017-09-27 11:00:14 +02:00

skd_s1120.h

skd: fix formatting in skd_s1120.h

2013-11-08 09:10:30 -07:00

smart1,2.h

fix typos 'comamnd' -> 'command' in comments

2011-02-02 11:31:21 +01:00

sunvdc.c

sunvdc: reconnect ldc after vds service domain restarts

2014-12-11 18:52:45 -08:00

swim3.c

powerpc: Move Power Macintosh drivers to generic byteswappers

2015-03-23 14:29:40 +11:00

swim_asm.S

m68k: mac - Add SWIM floppy support

2009-03-26 21:15:27 +01:00

swim.c

block: drop owner assignment from platform_drivers

2014-10-20 16:20:18 +02:00

sx8.c

block: rename REQ_TYPE_SPECIAL to REQ_TYPE_DRV_PRIV

2015-05-05 13:40:03 -06:00

umem.c

block: change ->make_request_fn() and users to return a queue cookie

2015-11-07 10:40:46 -07:00

umem.h

drivers/block/umem: trim trailing whitespace

2007-10-10 09:25:59 +02:00

virtio_blk.c

virtio_blk: fix panic in initialization error path

2017-08-11 09:08:58 -07:00

xen-blkfront.c

Merge tag 'for-linus-4.4-rc0-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

2015-11-04 17:32:42 -08:00

xsysace.c

block: systemace: Remove .owner field for driver

2014-08-21 20:37:54 -05:00

z2ram.c

block: remove struct request buffer member

2014-04-15 14:03:02 -06:00