From: Ming Lei <tom.leiming@gmail.com>
To: Hillf Danton <hdanton@sina.com>
Cc: Qu Wenruo <wqu@suse.com>, Christoph Hellwig <hch@lst.de>,
Damien Le Moal <dlemoal@kernel.org>,
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
Jens Axboe <axboe@kernel.dk>,
Bart Van Assche <bvanassche@acm.org>,
linux-block <linux-block@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
linux-btrfs@vger.kernel.org, David Sterba <dsterba@suse.com>,
linux-fsdevel@vger.kernel.org,
Christian Brauner <brauner@kernel.org>
Subject: Re: [PATCH v3] loop: Fix NULL pointer dereference in lo_rw_aio()
Date: Mon, 1 Jun 2026 18:36:19 -0500 [thread overview]
Message-ID: <ah4Xc7OmGle_C5M3@fedora> (raw)
In-Reply-To: <20260601231731.1403-1-hdanton@sina.com>
On Tue, Jun 02, 2026 at 07:17:30AM +0800, Hillf Danton wrote:
> On Mon, 1 Jun 2026 17:14:59 -0500 Ming Lei wrote:
> > On Tue, Jun 02, 2026 at 05:51:26AM +0800, Hillf Danton wrote:
> > > On OnMon, 1 Jun 2026 10:29:25 -0500 Ming Lei wrote:
> > > > syzbot log shows the null-ptr-deref is on WRITE, instead of DISCARD.
> > > >
> > > > https://syzkaller.appspot.com/bug?extid=cd8a9a308e879a4e2c28
> > > >
> > > > Adding WARN_ON(!lo->lo_backing_file) in loop_queue_rq() might capture
> > > > this bio submission context if this req isn't issued via wq.
> > > >
> > > I suspect this makes $.02 sense given the check of Lo_bound upon queuing rq.
> >
> > Can't lo->lo_state be updated after the check? It is totally lockless...
> >
> Sounds good hm... do you mean it is UNWISE to not flush the loop workqueue
> when closing disk?
Quite the opposite, it is wise to not flush wq in __loop_clr_fd(), please
see my previous comment.
Thanks,
Ming
next prev parent reply other threads:[~2026-06-01 23:36 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <ag0lS_CbKO9R5CV8@fedora>
[not found] ` <94076bc9-2c09-4bb6-8468-b6b8af419cb9@I-love.SAKURA.ne.jp>
[not found] ` <ag1nfIFcykmQHbkk@fedora>
[not found] ` <1ab8c579-eb76-4227-8a72-6ec819135219@I-love.SAKURA.ne.jp>
[not found] ` <ag1223nAa0wZ8ALC@fedora>
[not found] ` <fda8abc8-6aa2-463b-bf72-865f6b838034@I-love.SAKURA.ne.jp>
[not found] ` <ahRocb0Vs_m6RF_O@fedora>
[not found] ` <1a9f53d4-6f48-4df8-a3d8-2b0e442a163a@I-love.SAKURA.ne.jp>
[not found] ` <ahZGxoI6oHQ_vSrx@fedora>
[not found] ` <d1b5a737-f0e3-4927-b762-430b37fbb2f9@I-love.SAKURA.ne.jp>
2026-05-27 3:00 ` [PATCH v3] loop: Fix NULL pointer dereference in lo_rw_aio() Ming Lei
2026-05-27 11:29 ` Tetsuo Handa
2026-05-27 18:11 ` Damien Le Moal
2026-05-28 8:38 ` Christoph Hellwig
2026-05-28 10:16 ` Qu Wenruo
2026-06-01 14:40 ` Christoph Hellwig
2026-06-01 16:29 ` Brian Foster
2026-06-01 22:27 ` Qu Wenruo
2026-06-01 15:29 ` Ming Lei
2026-06-01 21:51 ` Hillf Danton
2026-06-01 22:14 ` Ming Lei
2026-06-01 23:17 ` Hillf Danton
2026-06-01 23:36 ` Ming Lei [this message]
2026-06-02 2:02 ` Hillf Danton
2026-05-28 5:43 ` Hillf Danton
2026-05-28 23:00 ` Hillf Danton
2026-05-29 0:14 ` Tetsuo Handa
2026-05-29 7:04 ` Hillf Danton
2026-05-29 22:05 ` Hillf Danton
2026-05-30 23:57 ` Tetsuo Handa
2026-06-07 10:54 ` [PATCH v4] " Tetsuo Handa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ah4Xc7OmGle_C5M3@fedora \
--to=tom.leiming@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=axboe@kernel.dk \
--cc=brauner@kernel.org \
--cc=bvanassche@acm.org \
--cc=dlemoal@kernel.org \
--cc=dsterba@suse.com \
--cc=hch@lst.de \
--cc=hdanton@sina.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-btrfs@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=torvalds@linux-foundation.org \
--cc=wqu@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox