lkml.org 
[lkml]   [2018]   [May]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 050/165] loop: fix LOOP_GET_STATUS lock imbalance
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Omar Sandoval <osandov@fb.com>

    commit bdac616db9bbadb90b7d6a406144571015e138f7 upstream.

    Commit 2d1d4c1e591f made loop_get_status() drop lo_ctx_mutex before
    returning, but the loop_get_status_old(), loop_get_status64(), and
    loop_get_status_compat() wrappers don't call loop_get_status() if the
    passed argument is NULL. The callers expect that the lock is dropped, so
    make sure we drop it in that case, too.

    Reported-by: syzbot+31e8daa8b3fc129e75f2@syzkaller.appspotmail.com
    Fixes: 2d1d4c1e591f ("loop: don't call into filesystem while holding lo_ctl_mutex")
    Signed-off-by: Omar Sandoval <osandov@fb.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/block/loop.c | 33 ++++++++++++++++++---------------
    1 file changed, 18 insertions(+), 15 deletions(-)

    --- a/drivers/block/loop.c
    +++ b/drivers/block/loop.c
    @@ -1282,12 +1282,13 @@ static int
    loop_get_status_old(struct loop_device *lo, struct loop_info __user *arg) {
    struct loop_info info;
    struct loop_info64 info64;
    - int err = 0;
    + int err;

    - if (!arg)
    - err = -EINVAL;
    - if (!err)
    - err = loop_get_status(lo, &info64);
    + if (!arg) {
    + mutex_unlock(&lo->lo_ctl_mutex);
    + return -EINVAL;
    + }
    + err = loop_get_status(lo, &info64);
    if (!err)
    err = loop_info64_to_old(&info64, &info);
    if (!err && copy_to_user(arg, &info, sizeof(info)))
    @@ -1299,12 +1300,13 @@ loop_get_status_old(struct loop_device *
    static int
    loop_get_status64(struct loop_device *lo, struct loop_info64 __user *arg) {
    struct loop_info64 info64;
    - int err = 0;
    + int err;

    - if (!arg)
    - err = -EINVAL;
    - if (!err)
    - err = loop_get_status(lo, &info64);
    + if (!arg) {
    + mutex_unlock(&lo->lo_ctl_mutex);
    + return -EINVAL;
    + }
    + err = loop_get_status(lo, &info64);
    if (!err && copy_to_user(arg, &info64, sizeof(info64)))
    err = -EFAULT;

    @@ -1525,12 +1527,13 @@ loop_get_status_compat(struct loop_devic
    struct compat_loop_info __user *arg)
    {
    struct loop_info64 info64;
    - int err = 0;
    + int err;

    - if (!arg)
    - err = -EINVAL;
    - if (!err)
    - err = loop_get_status(lo, &info64);
    + if (!arg) {
    + mutex_unlock(&lo->lo_ctl_mutex);
    + return -EINVAL;
    + }
    + err = loop_get_status(lo, &info64);
    if (!err)
    err = loop_info64_to_compat(&info64, arg);
    return err;

    \
     
     \ /
      Last update: 2018-05-24 13:17    [W:2.099 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site