Linus Torvalds 3cf852bbdf loop: fix concurrent lo_open/lo_release ...

范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.
The reason is due to insufficient serialization in lo_release(), which
will continue to use the loop device even after it has decremented the
lo_refcnt to zero.

In the meantime, another process can come in, open the loop device
again as it is being shut down. Confusion ensues.

Reported-by: 范龙飞 <long7573@126.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Git-commit: ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>

Conflicts:
	drivers/block/loop.c

Signed-off-by: Dheeraj Kumar Chaudhary <dheech@codeaurora.org>
Change-Id: I965ddcdc2a9d27fd56a54d2886b7c3861c21b05f
CVE-2018-5344
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>

2019-08-08 16:35:20 +02:00

..

aoe

…

drbd

…

mtip32xx

…

paride

…

xen-blkback

…

zram

…

amiflop.c

…

ataflop.c

…

brd.c

…

cciss_cmd.h

…

cciss_scsi.c

…

cciss_scsi.h

…

cciss.c

…

cciss.h

…

cpqarray.c

…

cpqarray.h

…

cryptoloop.c

…

DAC960.c

…

DAC960.h

…

floppy.c

…

hd.c

…

ida_cmd.h

…

ida_ioctl.h

…

Kconfig

…

loop.c

loop: fix concurrent lo_open/lo_release

2019-08-08 16:35:20 +02:00

Makefile

…

mg_disk.c

…

nbd.c

…

nvme.c

…

osdblk.c

…

pktcdvd.c

BACKPORT: block: add blk_rq_set_block_pc()

2019-08-06 12:26:35 +02:00

ps3disk.c

…

ps3vram.c

…

rbd_types.h

…

rbd.c

…

smart1,2.h

…

sunvdc.c

…

swim3.c

…

swim_asm.S

…

swim.c

…

sx8.c

…

ub.c

…

umem.c

…

umem.h

…

virtio_blk.c

…

xd.c

…

xd.h

…

xen-blkfront.c

…

xsysace.c

…

z2ram.c

…