diff options
| author | Linus Torvalds <[email protected]> | 2018-01-05 16:26:00 -0800 |
|---|---|---|
| committer | Jens Axboe <[email protected]> | 2018-01-06 09:32:07 -0700 |
| commit | ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5 (patch) | |
| tree | f581ac94d3f2c1e2059e04c392788b0ad4119ba8 /net/unix/af_unix.c | |
| parent | cbf3a95924d515c1883aec2322fec277e4726134 (diff) | |
loop: fix concurrent lo_open/lo_release
范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.
The reason is due to insufficient serialization in lo_release(), which
will continue to use the loop device even after it has decremented the
lo_refcnt to zero.
In the meantime, another process can come in, open the loop device
again as it is being shut down. Confusion ensues.
Reported-by: 范龙飞 <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>
Diffstat (limited to 'net/unix/af_unix.c')
0 files changed, 0 insertions, 0 deletions