From patchwork Fri Apr 6 16:57:03 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Omar Sandoval X-Patchwork-Id: 10327235 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9E0B360541 for ; Fri, 6 Apr 2018 16:57:14 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8C67A29068 for ; Fri, 6 Apr 2018 16:57:14 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 80D6E29271; Fri, 6 Apr 2018 16:57:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DE55F29068 for ; Fri, 6 Apr 2018 16:57:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751389AbeDFQ5N (ORCPT ); Fri, 6 Apr 2018 12:57:13 -0400 Received: from mail-pl0-f67.google.com ([209.85.160.67]:34740 "EHLO mail-pl0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750962AbeDFQ5M (ORCPT ); Fri, 6 Apr 2018 12:57:12 -0400 Received: by mail-pl0-f67.google.com with SMTP id y12-v6so882369plt.1 for ; Fri, 06 Apr 2018 09:57:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=osandov-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id; bh=h09eg9RSH7bhdmclBHUG7p23bFfMjN46JNgxvQGlqw8=; b=luUZYXuljjkIEv/s9oM5fvYe5fWr1oABNVsJTpcAj5qkAMmXZU7CdVGJ8ki8dfv3fq nf8iJc5rbFXsmR2H/bBSVtGHP0wPHFeMQGEBN6a82Iw0V+LnIwvLkPs8DBqa3C2vwxtx pvEn8YOWyqgCDnHs8gUSIaEJ60LJc6ioxn1Gf+Q7bTRZIibX8dxOJR4cYdRLtOQhS6Gv GYVsaEWAVuDzKfkbMVblMo8fkDE9ks/rCUCDxwNDfOpYzFhEOGzpptevoN8mWBWE+PEh wZQyY8BuZVrhJT59UWDN6WxEpPn7JRUYrECX7aFAkx8Ah4zMpI5jE/D/asnPQKy5AgiK kAIw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=h09eg9RSH7bhdmclBHUG7p23bFfMjN46JNgxvQGlqw8=; b=NZhR3plRooTrSFmxluMVt4U8IqzCKac9igpnmF7LGqLfOlSnd9rjIQn+r+NkHQPS8f b+q0Rlw7+JGUQlU6KqZcWx7E4TZphPgY6GdoHWPs8zs+3WUG+A4D2BORv7EjjMUd866v TBnduIvcaB6B0fqVNfo7XfPDWv1NTlTWLrwfCsQv+1RPhZl9k8Ht+83p1nDuPCiog+lY /kKTjyV2MycIRDBatyBUho2D7ibKB5l0FpIWiTbvXdQyd9f5Qd7aIVf62sW9u35lCU7p oLTGIN3X38G/27rY8FqYhKPqdzjr6giDHlg//2AG4/J1pREgLKvqbbnDX2zuyS4BtR7p jC2g== X-Gm-Message-State: AElRT7FhqICoDkJ992V5Hz6l4orP+BVNxuAFSqd1vIZEgxF7+7HFhCD6 SXNt2ywlb6YwUMryNfclE8m0nY9r9kE= X-Google-Smtp-Source: AIpwx48dmIJN14R7Z8Vz4SBN5mwowr8OXl/lDaoCdnd19PJP3KyVoaD0XiwrjPbuW7oNQQv5t/AT1A== X-Received: by 2002:a17:902:8482:: with SMTP id c2-v6mr28831995plo.295.1523033831458; Fri, 06 Apr 2018 09:57:11 -0700 (PDT) Received: from vader.thefacebook.com ([2620:10d:c090:200::4:a199]) by smtp.gmail.com with ESMTPSA id x29sm3980798pfk.68.2018.04.06.09.57.10 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 06 Apr 2018 09:57:10 -0700 (PDT) From: Omar Sandoval To: linux-block@vger.kernel.org Cc: Jens Axboe , kernel-team@fb.com, Tetsuo Handa , Dmitry Vyukov Subject: [PATCH] loop: fix LOOP_GET_STATUS lock imbalance Date: Fri, 6 Apr 2018 09:57:03 -0700 Message-Id: <6bee3eddc24ef5525ca12efb023e66b2503cb178.1523033157.git.osandov@fb.com> X-Mailer: git-send-email 2.17.0 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Omar Sandoval Commit 2d1d4c1e591f made loop_get_status() drop lo_ctx_mutex before returning, but the loop_get_status_old(), loop_get_status64(), and loop_get_status_compat() wrappers don't call loop_get_status() if the passed argument is NULL. The callers expect that the lock is dropped, so make sure we drop it in that case, too. Reported-by: syzbot+31e8daa8b3fc129e75f2@syzkaller.appspotmail.com Fixes: 2d1d4c1e591f ("loop: don't call into filesystem while holding lo_ctl_mutex") Signed-off-by: Omar Sandoval --- Based on Linus' tree. drivers/block/loop.c | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 264abaaff662..9b476fd2bc41 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1283,12 +1283,13 @@ static int loop_get_status_old(struct loop_device *lo, struct loop_info __user *arg) { struct loop_info info; struct loop_info64 info64; - int err = 0; + int err; - if (!arg) - err = -EINVAL; - if (!err) - err = loop_get_status(lo, &info64); + if (!arg) { + mutex_unlock(&lo->lo_ctl_mutex); + return -EINVAL; + } + err = loop_get_status(lo, &info64); if (!err) err = loop_info64_to_old(&info64, &info); if (!err && copy_to_user(arg, &info, sizeof(info))) @@ -1300,12 +1301,13 @@ loop_get_status_old(struct loop_device *lo, struct loop_info __user *arg) { static int loop_get_status64(struct loop_device *lo, struct loop_info64 __user *arg) { struct loop_info64 info64; - int err = 0; + int err; - if (!arg) - err = -EINVAL; - if (!err) - err = loop_get_status(lo, &info64); + if (!arg) { + mutex_unlock(&lo->lo_ctl_mutex); + return -EINVAL; + } + err = loop_get_status(lo, &info64); if (!err && copy_to_user(arg, &info64, sizeof(info64))) err = -EFAULT; @@ -1529,12 +1531,13 @@ loop_get_status_compat(struct loop_device *lo, struct compat_loop_info __user *arg) { struct loop_info64 info64; - int err = 0; + int err; - if (!arg) - err = -EINVAL; - if (!err) - err = loop_get_status(lo, &info64); + if (!arg) { + mutex_unlock(&lo->lo_ctl_mutex); + return -EINVAL; + } + err = loop_get_status(lo, &info64); if (!err) err = loop_info64_to_compat(&info64, arg); return err;