lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 26 Mar 2019 15:30:33 +0900
From:   Greg Kroah-Hartman <>
Cc:     Greg Kroah-Hartman <>,,,
        Dongli Zhang <>,
        Jan Kara <>, Jens Axboe <>
Subject: [PATCH 5.0 46/52] loop: access lo_backing_file only when the loop device is Lo_bound

5.0-stable review patch.  If anyone has any objections, please let me know.


From: Dongli Zhang <>

commit f7c8a4120eedf24c36090b7542b179ff7a649219 upstream.

Commit 758a58d0bc67 ("loop: set GENHD_FL_NO_PART_SCAN after
blkdev_reread_part()") separates "lo->lo_backing_file = NULL" and
"lo->lo_state = Lo_unbound" into different critical regions protected by

However, there is below race that the NULL lo->lo_backing_file would be
accessed when the backend of a loop is another loop device, e.g., loop0's
backend is a file, while loop1's backend is loop0.

loop0's backend is file            loop1's backend is loop0

  lo->lo_backing_file = NULL; --> set to NULL
                                       f = l->lo_backing_file; --> NULL
                                         access if loop0 is not Lo_unbound
  lo->lo_state = Lo_unbound;

lo->lo_backing_file should be accessed only when the loop device is

In fact, the problem has been introduced already in commit 7ccd0791d985
("loop: Push loop_ctl_mutex down into loop_clr_fd()") after which
loop_validate_file() could see devices in Lo_rundown state with which it
did not count. It was harmless at that point but still.

Fixes: 7ccd0791d985 ("loop: Push loop_ctl_mutex down into loop_clr_fd()")
Signed-off-by: Dongli Zhang <>
Reviewed-by: Jan Kara <>
Signed-off-by: Jens Axboe <>
Signed-off-by: Greg Kroah-Hartman <>

 drivers/block/loop.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -656,7 +656,7 @@ static int loop_validate_file(struct fil
 			return -EBADF;
 		l = f->f_mapping->host->i_bdev->bd_disk->private_data;
-		if (l->lo_state == Lo_unbound) {
+		if (l->lo_state != Lo_bound) {
 			return -EINVAL;
 		f = l->lo_backing_file;

Powered by blists - more mailing lists