Thinking a bit more, I really don't think the existing any refcount check protects us against a different tread modififying the backing file. When a process has a file descriptor to a loop device open and is multithreaded (or forks) we can still have multiple threads manipulating the loop state. That being said I do not think we really need that refcount check at all - once loop_clr_fd set lo->lo_state to Lo_rundown under the global lock we know that loop_validate_file will error out on it due to the lo_state != Lo_bound check.