[PATCH] loop: add sync_blockdev() in __loop_clr_fd() to prevent UAF

[Ming Lei <tom.leiming@gmail.com>]

The syzbot report describes a NULL pointer dereference in lo_rw_aio()
caused by a race between lo_release() and loop_queue_rq().
__loop_clr_fd() clears lo->lo_backing_file while an already-scheduled
asynchronous I/O work (lo_rw_aio) is about to execute on a kworker.
Since the kworker enters lo_rw_aio() after lo->lo_backing_file has been
set to NULL, it dereferences the NULL pointer when initializing the
kiocb, leading to a general protection fault.

Fix this by adding sync_blockdev() in __loop_clr_fd() to flush all
pending writeback I/O before clearing lo->lo_backing_file. Since the
loop disk is already closed at this point, no new I/O can be submitted
— only writeback remains.

Reported-by: syzbot+cd8a9a308e879a4e2c28@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cd8a9a308e879a4e2c28
Reported-by: syzbot+bc273027d5643e48e5b3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=bc273027d5643e48e5b3
Analyzed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Hongling Zeng <zenghongling@kylinos.cn>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Bart Van Assche <bvanassche@acm.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Link: https://lore.kernel.org/linux-block/9b2032d6-3f36-4d2b-8128-985c08a4fa37@I-love.SAKURA.ne.jp/
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
---
 drivers/block/loop.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 0000913f7efc..023e20a88a8a 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1118,6 +1118,9 @@ static void __loop_clr_fd(struct loop_device *lo)
 	struct file *filp;
 	gfp_t gfp = lo->old_gfp_mask;
 
+	/* flush outstanding writeback I/O before clearing lo_backing_file */
+	sync_blockdev(lo->lo_device);
+
 	spin_lock_irq(&lo->lo_lock);
 	filp = lo->lo_backing_file;
 	lo->lo_backing_file = NULL;
-- 
2.54.0