Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bdac616d authored by Omar Sandoval's avatar Omar Sandoval Committed by Jens Axboe
Browse files

loop: fix LOOP_GET_STATUS lock imbalance 



Commit 2d1d4c1e made loop_get_status() drop lo_ctx_mutex before
returning, but the loop_get_status_old(), loop_get_status64(), and
loop_get_status_compat() wrappers don't call loop_get_status() if the
passed argument is NULL. The callers expect that the lock is dropped, so
make sure we drop it in that case, too.

Reported-by: default avatar <syzbot+31e8daa8b3fc129e75f2@syzkaller.appspotmail.com>
Fixes: 2d1d4c1e ("loop: don't call into filesystem while holding lo_ctl_mutex")
Signed-off-by: default avatarOmar Sandoval <osandov@fb.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 1e047eaa

drivers/block/loop.c

+18 −15
Original line number Diff line number Diff line
@@ -1287,11 +1287,12 @@ static int 
loop_get_status_old(struct loop_device *lo, struct loop_info __user *arg) {

	struct loop_info info;

	struct loop_info64 info64;

	int err = 0;

	int err;



	if (!arg)

		err = -EINVAL;

	if (!err)

	if (!arg) {

		mutex_unlock(&lo->lo_ctl_mutex);

		return -EINVAL;

	}

	err = loop_get_status(lo, &info64);

	if (!err)

		err = loop_info64_to_old(&info64, &info);
@@ -1304,11 +1305,12 @@ loop_get_status_old(struct loop_device *lo, struct loop_info __user *arg) { 
static int

loop_get_status64(struct loop_device *lo, struct loop_info64 __user *arg) {

	struct loop_info64 info64;

	int err = 0;

	int err;



	if (!arg)

		err = -EINVAL;

	if (!err)

	if (!arg) {

		mutex_unlock(&lo->lo_ctl_mutex);

		return -EINVAL;

	}

	err = loop_get_status(lo, &info64);

	if (!err && copy_to_user(arg, &info64, sizeof(info64)))

		err = -EFAULT;
@@ -1533,11 +1535,12 @@ loop_get_status_compat(struct loop_device *lo, 
		       struct compat_loop_info __user *arg)

{

	struct loop_info64 info64;

	int err = 0;

	int err;



	if (!arg)

		err = -EINVAL;

	if (!err)

	if (!arg) {

		mutex_unlock(&lo->lo_ctl_mutex);

		return -EINVAL;

	}

	err = loop_get_status(lo, &info64);

	if (!err)

		err = loop_info64_to_compat(&info64, arg);