tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

loop: don't change loop device under exclusive opener in loop_set_status

loop_set_status() is allowed to change the loop device while there
are other openers of the device, even exclusive ones.

In this case, it causes a KASAN: slab-out-of-bounds Read in
ext4_search_dir(), since when looking for an entry in an inlined
directory, e_value_offs is changed underneath the filesystem by
loop_set_status().

Fix the problem by forbidding loop_set_status() from modifying the loop
device while there are exclusive openers of the device. This is similar
to the fix in loop_configure() by commit 33ec3e53e7b1 ("loop: Don't
change loop device under exclusive opener") alongside commit ecbe6bc0003b
("block: use bd_prepare_to_claim directly in the loop driver").

Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Tested-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Tested-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

authored by

Raphael Pinsonneault-Thibeault and committed by
Jens Axboe 08e136eb 69153e8b

+30 -11
+30 -11
drivers/block/loop.c
··· 1225 1225 } 1226 1226 1227 1227 static int 1228 - loop_set_status(struct loop_device *lo, const struct loop_info64 *info) 1228 + loop_set_status(struct loop_device *lo, blk_mode_t mode, 1229 + struct block_device *bdev, const struct loop_info64 *info) 1229 1230 { 1230 1231 int err; 1231 1232 bool partscan = false; 1232 1233 bool size_changed = false; 1233 1234 unsigned int memflags; 1235 + 1236 + /* 1237 + * If we don't hold exclusive handle for the device, upgrade to it 1238 + * here to avoid changing device under exclusive owner. 1239 + */ 1240 + if (!(mode & BLK_OPEN_EXCL)) { 1241 + err = bd_prepare_to_claim(bdev, loop_set_status, NULL); 1242 + if (err) 1243 + goto out_reread_partitions; 1244 + } 1234 1245 1235 1246 err = mutex_lock_killable(&lo->lo_mutex); 1236 1247 if (err) ··· 1284 1273 } 1285 1274 out_unlock: 1286 1275 mutex_unlock(&lo->lo_mutex); 1276 + if (!(mode & BLK_OPEN_EXCL)) 1277 + bd_abort_claiming(bdev, loop_set_status); 1278 + out_reread_partitions: 1287 1279 if (partscan) 1288 1280 loop_reread_partitions(lo); 1289 1281 ··· 1366 1352 } 1367 1353 1368 1354 static int 1369 - loop_set_status_old(struct loop_device *lo, const struct loop_info __user *arg) 1355 + loop_set_status_old(struct loop_device *lo, blk_mode_t mode, 1356 + struct block_device *bdev, 1357 + const struct loop_info __user *arg) 1370 1358 { 1371 1359 struct loop_info info; 1372 1360 struct loop_info64 info64; ··· 1376 1360 if (copy_from_user(&info, arg, sizeof (struct loop_info))) 1377 1361 return -EFAULT; 1378 1362 loop_info64_from_old(&info, &info64); 1379 - return loop_set_status(lo, &info64); 1363 + return loop_set_status(lo, mode, bdev, &info64); 1380 1364 } 1381 1365 1382 1366 static int 1383 - loop_set_status64(struct loop_device *lo, const struct loop_info64 __user *arg) 1367 + loop_set_status64(struct loop_device *lo, blk_mode_t mode, 1368 + struct block_device *bdev, 1369 + const struct loop_info64 __user *arg) 1384 1370 { 1385 1371 struct loop_info64 info64; 1386 1372 1387 1373 if (copy_from_user(&info64, arg, sizeof (struct loop_info64))) 1388 1374 return -EFAULT; 1389 - return loop_set_status(lo, &info64); 1375 + return loop_set_status(lo, mode, bdev, &info64); 1390 1376 } 1391 1377 1392 1378 static int ··· 1567 1549 case LOOP_SET_STATUS: 1568 1550 err = -EPERM; 1569 1551 if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN)) 1570 - err = loop_set_status_old(lo, argp); 1552 + err = loop_set_status_old(lo, mode, bdev, argp); 1571 1553 break; 1572 1554 case LOOP_GET_STATUS: 1573 1555 return loop_get_status_old(lo, argp); 1574 1556 case LOOP_SET_STATUS64: 1575 1557 err = -EPERM; 1576 1558 if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN)) 1577 - err = loop_set_status64(lo, argp); 1559 + err = loop_set_status64(lo, mode, bdev, argp); 1578 1560 break; 1579 1561 case LOOP_GET_STATUS64: 1580 1562 return loop_get_status64(lo, argp); ··· 1668 1650 } 1669 1651 1670 1652 static int 1671 - loop_set_status_compat(struct loop_device *lo, 1672 - const struct compat_loop_info __user *arg) 1653 + loop_set_status_compat(struct loop_device *lo, blk_mode_t mode, 1654 + struct block_device *bdev, 1655 + const struct compat_loop_info __user *arg) 1673 1656 { 1674 1657 struct loop_info64 info64; 1675 1658 int ret; ··· 1678 1659 ret = loop_info64_from_compat(arg, &info64); 1679 1660 if (ret < 0) 1680 1661 return ret; 1681 - return loop_set_status(lo, &info64); 1662 + return loop_set_status(lo, mode, bdev, &info64); 1682 1663 } 1683 1664 1684 1665 static int ··· 1704 1685 1705 1686 switch(cmd) { 1706 1687 case LOOP_SET_STATUS: 1707 - err = loop_set_status_compat(lo, 1688 + err = loop_set_status_compat(lo, mode, bdev, 1708 1689 (const struct compat_loop_info __user *)arg); 1709 1690 break; 1710 1691 case LOOP_GET_STATUS: