On Tue, May 08, 2018 at 05:45:21AM +0900, Tetsuo Handa wrote: > > > > > By the way, are you aware that current "/* Avoid recursion */" loop is not thread safe? > > > > Actually, it is safe. While the child loop device has an open file on > > the parent, lo_refcnt is elevated, which prevents loop_clr_fd from > > actually set setting lo_state to Lo_rundown and clearing > > lo_backing_file > > If you think it is safe, please explain that the crash referenced in a patch > at https://groups.google.com/d/msg/syzkaller-bugs/2Rw8-OM6IbM/PzdobV8kAgAJ is > no longer possible. syzbot is hitting crashes there. Huh? You were worried about a race where loop_change_fd could race with loop_clr_fd causing a NULL dereference of lo_backing_file. The mail thread you are referencing is a deadlock problem with loop_reread_partitions() and lo_release(). This is unreleated to the possible race you were concerned about in loop_change_fd(). - Ted
