| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <i5xuxe6prso72euxxo4jludbb5fb2juh2ofbgf32ts7aruyesc@na6btym6jats>
Date: Tue, 2 Dec 2025 11:07:06 +0100
From: Jan Kara <jack@...e.cz>
To: Raphael Pinsonneault-Thibeault <rpthibeault@...il.com>
Cc: axboe@...nel.dk, linux-block@...r.kernel.org,
linux-kernel@...r.kernel.org, jack@...e.cz, cascardo@...lia.com,
linux-kernel-mentees@...ts.linux.dev, skhan@...uxfoundation.org,
syzbot+3ee481e21fd75e14c397@...kaller.appspotmail.com
Subject: Re: [PATCH] loop: don't change loop device under exclusive opener in
loop_set_status
On Fri 14-11-25 09:42:05, Raphael Pinsonneault-Thibeault wrote:
> loop_set_status() is allowed to change the loop device while there
> are other openers of the device, even exclusive ones.
>
> In this case, it causes a KASAN: slab-out-of-bounds Read in
> ext4_search_dir(), since when looking for an entry in an inlined
> directory, e_value_offs is changed underneath the filesystem by
> loop_set_status().
>
> Fix the problem by forbidding loop_set_status() from modifying the loop
> device while there are exclusive openers of the device. This is similar
> to the fix in loop_configure() by commit 33ec3e53e7b1 ("loop: Don't
> change loop device under exclusive opener") alongside commit ecbe6bc0003b
> ("block: use bd_prepare_to_claim directly in the loop driver").
>
> Reported-by: syzbot+3ee481e21fd75e14c397@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
> Tested-by: syzbot+3ee481e21fd75e14c397@...kaller.appspotmail.com
> Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@...il.com>
This patch looks mostly good to me. Just one comment:
> -loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
> +loop_set_status(struct loop_device *lo, blk_mode_t mode,
> + struct block_device *bdev, const struct loop_info64 *info)
> {
> int err;
> bool partscan = false;
> bool size_changed = false;
> unsigned int memflags;
>
> + /*
> + * If we don't hold exclusive handle for the device, upgrade to it
> + * here to avoid changing device under exclusive owner.
> + */
> + if (!(mode & BLK_OPEN_EXCL)) {
> + err = bd_prepare_to_claim(bdev, loop_set_status, NULL);
> + if (err)
> + goto out_reread_partitions;
> + }
> +
So now any LOOP_SET_STATUS call will fail for device that is already
exclusively open. There are some operations (like modifying the AUTOCLEAR
flag or loop device name) that are safe even for a device with a mounted
filesystem. I wouldn't probably bother with that now but I wanted to note
that there may be valid uses of LOOP_SET_STATUS even for an exclusively
open loop device and if there are users of that out there we might need to
refine this a bit. Anyway for now feel free to add:
Reviewed-by: Jan Kara <jack@...e.cz>
Honza
> err = mutex_lock_killable(&lo->lo_mutex);
> if (err)
> return err;
> @@ -1270,6 +1281,9 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
> }
> out_unlock:
> mutex_unlock(&lo->lo_mutex);
> + if (!(mode & BLK_OPEN_EXCL))
> + bd_abort_claiming(bdev, loop_set_status);
> +out_reread_partitions:
> if (partscan)
> loop_reread_partitions(lo);
>
> @@ -1349,7 +1363,9 @@ loop_info64_to_old(const struct loop_info64 *info64, struct loop_info *info)
> }
>
> static int
> -loop_set_status_old(struct loop_device *lo, const struct loop_info __user *arg)
> +loop_set_status_old(struct loop_device *lo, blk_mode_t mode,
> + struct block_device *bdev,
> + const struct loop_info __user *arg)
> {
> struct loop_info info;
> struct loop_info64 info64;
> @@ -1357,17 +1373,19 @@ loop_set_status_old(struct loop_device *lo, const struct loop_info __user *arg)
> if (copy_from_user(&info, arg, sizeof (struct loop_info)))
> return -EFAULT;
> loop_info64_from_old(&info, &info64);
> - return loop_set_status(lo, &info64);
> + return loop_set_status(lo, mode, bdev, &info64);
> }
>
> static int
> -loop_set_status64(struct loop_device *lo, const struct loop_info64 __user *arg)
> +loop_set_status64(struct loop_device *lo, blk_mode_t mode,
> + struct block_device *bdev,
> + const struct loop_info64 __user *arg)
> {
> struct loop_info64 info64;
>
> if (copy_from_user(&info64, arg, sizeof (struct loop_info64)))
> return -EFAULT;
> - return loop_set_status(lo, &info64);
> + return loop_set_status(lo, mode, bdev, &info64);
> }
>
> static int
> @@ -1546,14 +1564,14 @@ static int lo_ioctl(struct block_device *bdev, blk_mode_t mode,
> case LOOP_SET_STATUS:
> err = -EPERM;
> if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN))
> - err = loop_set_status_old(lo, argp);
> + err = loop_set_status_old(lo, mode, bdev, argp);
> break;
> case LOOP_GET_STATUS:
> return loop_get_status_old(lo, argp);
> case LOOP_SET_STATUS64:
> err = -EPERM;
> if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN))
> - err = loop_set_status64(lo, argp);
> + err = loop_set_status64(lo, mode, bdev, argp);
> break;
> case LOOP_GET_STATUS64:
> return loop_get_status64(lo, argp);
> @@ -1647,8 +1665,9 @@ loop_info64_to_compat(const struct loop_info64 *info64,
> }
>
> static int
> -loop_set_status_compat(struct loop_device *lo,
> - const struct compat_loop_info __user *arg)
> +loop_set_status_compat(struct loop_device *lo, blk_mode_t mode,
> + struct block_device *bdev,
> + const struct compat_loop_info __user *arg)
> {
> struct loop_info64 info64;
> int ret;
> @@ -1656,7 +1675,7 @@ loop_set_status_compat(struct loop_device *lo,
> ret = loop_info64_from_compat(arg, &info64);
> if (ret < 0)
> return ret;
> - return loop_set_status(lo, &info64);
> + return loop_set_status(lo, mode, bdev, &info64);
> }
>
> static int
> @@ -1682,7 +1701,7 @@ static int lo_compat_ioctl(struct block_device *bdev, blk_mode_t mode,
>
> switch(cmd) {
> case LOOP_SET_STATUS:
> - err = loop_set_status_compat(lo,
> + err = loop_set_status_compat(lo, mode, bdev,
> (const struct compat_loop_info __user *)arg);
> break;
> case LOOP_GET_STATUS:
> --
> 2.43.0
>
--
Jan Kara <jack@...e.com>
SUSE Labs, CR
Powered by blists - more mailing lists