Re: [PATCH] loop: add sync_blockdev() in __loop_clr_fd() to prevent UAF

[Ming Lei <tom.leiming@gmail.com>]

On Fri, May 22, 2026 at 12:28:34PM +0900, Tetsuo Handa wrote:
> On 2026/05/22 11:54, Ming Lei wrote:
> > Fix this by adding sync_blockdev() in __loop_clr_fd() to flush all
> > pending writeback I/O before clearing lo->lo_backing_file. Since the
> > loop disk is already closed at this point, no new I/O can be submitted
> > — only writeback remains.
> 
> Why can you assume that synchronize_rcu() + drain_workqueue(lo->workqueue)
> is unnecessary? Since we don't know exact commit which is causing this
> problem, we don't know what has changed.

When sync_blockdev() returns, there can't be any inflight IO:

- no one can open this loop disk
- no dirty page cache any more

So why do you want to add rcu/drain_workqueue?

Fixes: 1fe0b1acb14d ("loop: only freeze the queue in __loop_clr_fd when needed")


Thanks,
Ming