On Tue, May 08, 2018 at 05:45:21AM +0900, Tetsuo Handa wrote:
> >
> > > By the way, are you aware that current "/* Avoid recursion */" loop is
> > > not thread safe?
> >
> > Actually, it is safe. While the child loop device has an open file on
> > the parent, lo_refcnt is elevated, which prevents loop_clr_fd from
> > actually set setting lo_state to Lo_rundown and clearing
> > lo_backing_file
>
> If you think it is safe, please explain that the crash referenced in a patch
> at https://groups.google.com/d/msg/syzkaller-bugs/2Rw8-OM6IbM/PzdobV8kAgAJ is
> no longer possible. syzbot is hitting crashes there.
Huh? You were worried about a race where loop_change_fd could race
with loop_clr_fd causing a NULL dereference of lo_backing_file.
The mail thread you are referencing is a deadlock problem with
loop_reread_partitions() and lo_release(). This is unreleated to the
possible race you were concerned about in loop_change_fd().
- Ted
