linux-kernel - 回复: [PATCH V5] loop: Add sanity check for read/write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID:
 <BL1PR11MB5979C666DA3BC228C2C30E92869FA@BL1PR11MB5979.namprd11.prod.outlook.com>
Date: Tue, 20 May 2025 06:29:48 +0000
From: "Xu, Lizhi" <Lizhi.Xu@...driver.com>
To: Christian Hesse <mail@...rm.de>
CC: "axboe@...nel.dk" <axboe@...nel.dk>,
        "christian@...sel.eu"
	<christian@...sel.eu>,
        "hch@...radead.org" <hch@...radead.org>,
        "linux-block@...r.kernel.org" <linux-block@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "ming.lei@...hat.com" <ming.lei@...hat.com>,
        "syzbot+6af973a3b8dfd2faefdc@...kaller.appspotmail.com"
	<syzbot+6af973a3b8dfd2faefdc@...kaller.appspotmail.com>,
        "syzkaller-bugs@...glegroups.com" <syzkaller-bugs@...glegroups.com>
Subject:
 回复: [PATCH V5] loop: Add sanity check for read/write_iter

I figured out your steps to reproduce, and yes, this problem will occur if you do losetup with a file in a filesystem that does not support read_iter, which is what this patch does.

________________________________________
发件人: Christian Hesse
已发送: 2025 年 5 月 20 日 星期二 13:39
收件人: Xu, Lizhi
抄送: axboe@...nel.dk; christian@...sel.eu; hch@...radead.org; linux-block@...r.kernel.org; linux-kernel@...r.kernel.org; ming.lei@...hat.com; syzbot+6af973a3b8dfd2faefdc@...kaller.appspotmail.com; syzkaller-bugs@...glegroups.com
主题: Re: [PATCH V5] loop: Add sanity check for read/write_iter

Lizhi Xu <lizhi.xu@...driver.com> on Tue, 2025/05/20 11:00:
> On Mon, 19 May 2025 17:56:40 +0200, Christian Hesse wrote:
> > $ losetup --find --show --read-only --
> > /run/archiso/bootmnt/arch/x86_64/airootfs.sfs losetup:
> > /run/archiso/bootmnt/arch/x86_64/airootfs.sfs: failed to set up loop
> > device: Invalid argument
>
> I tried to reproduce the problem you mentioned using the kernel containing
> "commit:f5c84eff", but failed to reproduce it.
> The complete reproduction steps are as follows:
> 
> sudo apt install squashfs-tools debootstrap
> sudo debootstrap --arch=amd64 focal rootfs http://archive.ubuntu.com/ubuntu/
> sudo mksquashfs rootfs rootfs.sfs -comp xz -e boot
> [...]

That's the wrong end of the stack. After all squashfs is not directly
involved here (that was just an etxra info on why we have a loopback file
inside iso9660).

The issue is setting up the loopback file inside a mounted iso9660 filesystem.
Take these steps for easy reproduction:

root@...a ~ # mkdir iso.d 
root@...a ~ # truncate -s 10m iso.d/loopback.img
root@...a ~ # mkisofs -o iso.iso iso.d/
Setting input-charset to 'UTF-8' from locale.
 94,75% done, estimate finish Tue May 20 07:34:52 2025
Total translation table size: 0
Total rockridge attributes bytes: 0
Total directory bytes: 0
Path table size(bytes): 10
Max brk space used 0
5294 extents written (10 MB)
root@...a ~ # mount -o loop iso.iso /mnt/tmp 
mount: /mnt/tmp: WARNING: source write-protected, mounted read-only.
root@...a ~ # losetup --find --show --read-only -- /mnt/tmp/loopback.img 
losetup: /mnt/tmp/loopback.img: failed to set up loop device: Invalid argument

Hope that helps, let me know if you need more assistance.
-- 
Best regards,
Chris