[PATCH] loop: fix LOOP_GET_STATUS lock imbalance

[Omar Sandoval]

From: Omar Sandoval <osan...@fb.com>

Commit 2d1d4c1e591f made loop_get_status() drop lo_ctx_mutex before
returning, but the loop_get_status_old(), loop_get_status64(), and
loop_get_status_compat() wrappers don't call loop_get_status() if the
passed argument is NULL. The callers expect that the lock is dropped, so
make sure we drop it in that case, too.

Advertising

Reported-by: syzbot+31e8daa8b3fc129e7...@syzkaller.appspotmail.com
Fixes: 2d1d4c1e591f ("loop: don't call into filesystem while holding 
lo_ctl_mutex")
Signed-off-by: Omar Sandoval <osan...@fb.com>
---
Based on Linus' tree.

 drivers/block/loop.c | 33 ++++++++++++++++++---------------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 264abaaff662..9b476fd2bc41 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1283,12 +1283,13 @@ static int
 loop_get_status_old(struct loop_device *lo, struct loop_info __user *arg) {
        struct loop_info info;
        struct loop_info64 info64;
-       int err = 0;
+       int err;
 
-       if (!arg)
-               err = -EINVAL;
-       if (!err)
-               err = loop_get_status(lo, &info64);
+       if (!arg) {
+               mutex_unlock(&lo->lo_ctl_mutex);
+               return -EINVAL;
+       }
+       err = loop_get_status(lo, &info64);
        if (!err)
                err = loop_info64_to_old(&info64, &info);
        if (!err && copy_to_user(arg, &info, sizeof(info)))
@@ -1300,12 +1301,13 @@ loop_get_status_old(struct loop_device *lo, struct 
loop_info __user *arg) {
 static int
 loop_get_status64(struct loop_device *lo, struct loop_info64 __user *arg) {
        struct loop_info64 info64;
-       int err = 0;
+       int err;
 
-       if (!arg)
-               err = -EINVAL;
-       if (!err)
-               err = loop_get_status(lo, &info64);
+       if (!arg) {
+               mutex_unlock(&lo->lo_ctl_mutex);
+               return -EINVAL;
+       }
+       err = loop_get_status(lo, &info64);
        if (!err && copy_to_user(arg, &info64, sizeof(info64)))
                err = -EFAULT;
 
@@ -1529,12 +1531,13 @@ loop_get_status_compat(struct loop_device *lo,
                       struct compat_loop_info __user *arg)
 {
        struct loop_info64 info64;
-       int err = 0;
+       int err;
 
-       if (!arg)
-               err = -EINVAL;
-       if (!err)
-               err = loop_get_status(lo, &info64);
+       if (!arg) {
+               mutex_unlock(&lo->lo_ctl_mutex);
+               return -EINVAL;
+       }
+       err = loop_get_status(lo, &info64);
        if (!err)
                err = loop_info64_to_compat(&info64, arg);
        return err;
-- 
2.17.0