Commits
Linus Torvalds authored and Konstantin Khorenko committed d1255da44c7
ms/loop: fix concurrent lo_open/lo_release 范龙飞 reports that KASAN can report a use-after-free in __lock_acquire. The reason is due to insufficient serialization in lo_release(), which will continue to use the loop device even after it has decremented the lo_refcnt to zero. In the meantime, another process can come in, open the loop device again as it is being shut down. Confusion ensues. Reported-by: 范龙飞 <long7573@126.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Jens Axboe <axboe@kernel.dk> (cherry picked from commit ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5) CVE-2018-5344 https://jira.sw.ru/browse/PSBM-80876 Signed-off-by: Evgenii Shatokhin <eshatokhin@virtuozzo.com>