diff options
author | Jeremy Cline <jeremy@jcline.org> | 2018-01-12 10:50:02 -0500 |
---|---|---|
committer | Jeremy Cline <jeremy@jcline.org> | 2018-01-12 10:52:40 -0500 |
commit | 2a754e66fc7f7e2a9f695ee7aac775bf11b51f12 (patch) | |
tree | 0acf9e98379d30e034afec6823ff56458c814c5e /loop-fix-concurrent-lo_open-lo_release.patch | |
parent | 72428d11813ace3c8d187269ba80fa887806cdc7 (diff) | |
download | kernel-2a754e66fc7f7e2a9f695ee7aac775bf11b51f12.tar.gz kernel-2a754e66fc7f7e2a9f695ee7aac775bf11b51f12.tar.xz kernel-2a754e66fc7f7e2a9f695ee7aac775bf11b51f12.zip |
Fix CVE-2018-5344 (rhbz 1533909 1533911)
Diffstat (limited to 'loop-fix-concurrent-lo_open-lo_release.patch')
-rw-r--r-- | loop-fix-concurrent-lo_open-lo_release.patch | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/loop-fix-concurrent-lo_open-lo_release.patch b/loop-fix-concurrent-lo_open-lo_release.patch new file mode 100644 index 000000000..37131a702 --- /dev/null +++ b/loop-fix-concurrent-lo_open-lo_release.patch @@ -0,0 +1,55 @@ +From ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds <torvalds@linux-foundation.org> +Date: Fri, 5 Jan 2018 16:26:00 -0800 +Subject: [PATCH] loop: fix concurrent lo_open/lo_release +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +范龙飞 reports that KASAN can report a use-after-free in __lock_acquire. +The reason is due to insufficient serialization in lo_release(), which +will continue to use the loop device even after it has decremented the +lo_refcnt to zero. + +In the meantime, another process can come in, open the loop device +again as it is being shut down. Confusion ensues. + +Reported-by: 范龙飞 <long7573@126.com> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Jens Axboe <axboe@kernel.dk> +--- + drivers/block/loop.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index bc8e61506968..d5fe720cf149 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1581,9 +1581,8 @@ static int lo_open(struct block_device *bdev, fmode_t mode) + return err; + } + +-static void lo_release(struct gendisk *disk, fmode_t mode) ++static void __lo_release(struct loop_device *lo) + { +- struct loop_device *lo = disk->private_data; + int err; + + if (atomic_dec_return(&lo->lo_refcnt)) +@@ -1610,6 +1609,13 @@ static void lo_release(struct gendisk *disk, fmode_t mode) + mutex_unlock(&lo->lo_ctl_mutex); + } + ++static void lo_release(struct gendisk *disk, fmode_t mode) ++{ ++ mutex_lock(&loop_index_mutex); ++ __lo_release(disk->private_data); ++ mutex_unlock(&loop_index_mutex); ++} ++ + static const struct block_device_operations lo_fops = { + .owner = THIS_MODULE, + .open = lo_open, +-- +2.15.1 + |