Searched hist:ae665016 (Results 1 – 1 of 1) sorted by relevance
/openbmc/linux/drivers/block/ |
H A D | loop.c | ae665016 Fri Jan 05 18:26:00 CST 2018 Linus Torvalds <torvalds@linux-foundation.org> loop: fix concurrent lo_open/lo_release
范龙飞 reports that KASAN can report a use-after-free in __lock_acquire. The reason is due to insufficient serialization in lo_release(), which will continue to use the loop device even after it has decremented the lo_refcnt to zero.
In the meantime, another process can come in, open the loop device again as it is being shut down. Confusion ensues.
Reported-by: 范龙飞 <long7573@126.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Jens Axboe <axboe@kernel.dk> ae665016 Fri Jan 05 18:26:00 CST 2018 Linus Torvalds <torvalds@linux-foundation.org> loop: fix concurrent lo_open/lo_release 范龙飞 reports that KASAN can report a use-after-free in __lock_acquire. The reason is due to insufficient serialization in lo_release(), which will continue to use the loop device even after it has decremented the lo_refcnt to zero. In the meantime, another process can come in, open the loop device again as it is being shut down. Confusion ensues. Reported-by: 范龙飞 <long7573@126.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
|