tree 0fb845751ff6bcb8aa6a3bc5f441b226510dbab1
parent 9a53f96f55041a7045b2020438f3dd6ff5ffeab7
author Linus Torvalds <torvalds@linux-foundation.org> 1515198360 -0800
committer ChromeOS Commit Bot <chromeos-commit-bot@chromium.org> 1517995001 +0000

UPSTREAM: loop: fix concurrent lo_open/lo_release

范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.
The reason is due to insufficient serialization in lo_release(), which
will continue to use the loop device even after it has decremented the
lo_refcnt to zero.

In the meantime, another process can come in, open the loop device
again as it is being shut down. Confusion ensues.

BUG=chromium:808389
TEST=Build and run

Change-Id: Iad871f952c3eda1ef8e6336876fa6d10062e35c6
Reported-by: 范龙飞 <long7573@126.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5)
Reviewed-on: https://chromium-review.googlesource.com/900825