Re: [PATCH] block/loop: Fix NULL pointer dereference in lo_rw_aio()

[Ming Lei <tom.leiming@gmail.com>]

On Tue, May 19, 2026 at 05:14:30PM +0800, Hongling Zeng wrote:
>   Hi Ming,
> 
> Tetsuo’s syzkaller trace confirms the root cause:
> 
> Timeline:
>   T6142: lo_rw_aio(loop3) starting read with raw_refcnt=0x0, refcnt=1
>   T44:   lo_rw_aio(loop3) starting read with raw_refcnt=0x0, refcnt=1
>   T6148: __loop_clr_fd(loop3) clearing lo_backing_file with raw_refcnt=0x0,
> refcnt=1
>   T180:  lo_rw_aio(loop3) starting write with NULL file (already cleared?)
>   T180:   CRASH - null-ptr-deref

IO could be from writeback or early close, so the following patch should help:

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 0000913f7efc..24654a03db71 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1118,6 +1118,8 @@ static void __loop_clr_fd(struct loop_device *lo)
 	struct file *filp;
 	gfp_t gfp = lo->old_gfp_mask;
 
+	drain_workqueue(lo->workqueue);
+
 	spin_lock_irq(&lo->lo_lock);
 	filp = lo->lo_backing_file;
 	lo->lo_backing_file = NULL;
@@ -1857,9 +1859,6 @@ static blk_status_t loop_queue_rq(struct blk_mq_hw_ctx *hctx,
 
 	blk_mq_start_request(rq);
 
-	if (data_race(READ_ONCE(lo->lo_state)) != Lo_bound)
-		return BLK_STS_IOERR;
-
 	switch (req_op(rq)) {
 	case REQ_OP_FLUSH:
 	case REQ_OP_DISCARD:
@@ -1901,6 +1900,11 @@ static void loop_handle_cmd(struct loop_cmd *cmd)
 	int ret = 0;
 	struct mem_cgroup *old_memcg = NULL;
 
+	if (data_race(READ_ONCE(lo->lo_state)) != Lo_bound) {
+		ret = -EIO;
+		goto failed;
+	}
+
 	if (write && (lo->lo_flags & LO_FLAGS_READ_ONLY)) {
 		ret = -EIO;
 		goto failed;

> 
> Key anomaly: |raw_refcnt=0|while |refcnt=1|.
> This means |__loop_clr_fd()|runs while I/O is still active.
> Regression introduced by:
> 6050fa4c84cc ("loop: don't hold lo_mutex during __loop_clr_fd()")

Why do you conclude it is caused by above commit?


Thanks,
Ming