linux-kernel - [PATCH] loop: Add sanity check for read/write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250425034057.3133195-1-lizhi.xu@windriver.com>
Date: Fri, 25 Apr 2025 11:40:57 +0800
From: Lizhi Xu <lizhi.xu@...driver.com>
To: <syzbot+6af973a3b8dfd2faefdc@...kaller.appspotmail.com>
CC: <axboe@...nel.dk>, <linux-block@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <syzkaller-bugs@...glegroups.com>
Subject: [PATCH] loop: Add sanity check for read/write_iter

Some file systems do not support read_iter or write_iter, such as selinuxfs
in this issue.
So before calling them, first confirm that the interface is supported and
then call it.

Reported-by: syzbot+6af973a3b8dfd2faefdc@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6af973a3b8dfd2faefdc
Signed-off-by: Lizhi Xu <lizhi.xu@...driver.com>
---
 drivers/block/loop.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 674527d770dc..4f968e3071ed 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -449,10 +449,15 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
 	cmd->iocb.ki_flags = IOCB_DIRECT;
 	cmd->iocb.ki_ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_NONE, 0);
 
-	if (rw == ITER_SOURCE)
-		ret = file->f_op->write_iter(&cmd->iocb, &iter);
-	else
-		ret = file->f_op->read_iter(&cmd->iocb, &iter);
+	ret = 0;
+	if (rw == ITER_SOURCE) {
+		if (likely(file->f_op->write_iter))
+			ret = file->f_op->write_iter(&cmd->iocb, &iter);
+	}
+	else {
+		if (likely(file->f_op->read_iter))
+			ret = file->f_op->read_iter(&cmd->iocb, &iter);
+	}
 
 	lo_rw_aio_do_completion(cmd);
 
-- 
2.43.0