tag 55e7aebddd8b73fdd0c11f036379e3ccbedcfcaa
tagger The Android Open Source Project <initial-contribution@android.com> Mon May 07 15:33:28 2018 -0700
object e2c279d1e4d524befd538fd8b81c00bd463f527e

Android 8.1.0 Release 0.57 (OPM4.171019.016.C1,ryu)

commit e2c279d1e4d524befd538fd8b81c00bd463f527e
author Linus Torvalds <torvalds@linux-foundation.org> Fri Jan 05 16:26:00 2018 -0800
committer Siyuan Zhou <siyuanzhou@google.com> Fri Mar 09 05:28:00 2018 +0000
tree 05e45debc519c0aaf2c2db065142fab462c97665
parent 61482690008b0cee7dae83feeeaf6c6b04a21849

loop: fix concurrent lo_open/lo_release

commit ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5 upstream.

范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.
The reason is due to insufficient serialization in lo_release(), which
will continue to use the loop device even after it has decremented the
lo_refcnt to zero.

In the meantime, another process can come in, open the loop device
again as it is being shut down. Confusion ensues.

Reported-by: 范龙飞 <long7573@126.com>
Bug: 72867809
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I4ee94fca4ad13e227fbeffd4e2cba458c4d6e5c4