Commit 08e136eb authored by Raphael Pinsonneault-Thibeault's avatar Raphael Pinsonneault-Thibeault Committed by Jens Axboe
Browse files

loop: don't change loop device under exclusive opener in loop_set_status 



loop_set_status() is allowed to change the loop device while there
are other openers of the device, even exclusive ones.

In this case, it causes a KASAN: slab-out-of-bounds Read in
ext4_search_dir(), since when looking for an entry in an inlined
directory, e_value_offs is changed underneath the filesystem by
loop_set_status().

Fix the problem by forbidding loop_set_status() from modifying the loop
device while there are exclusive openers of the device. This is similar
to the fix in loop_configure() by commit 33ec3e53 ("loop: Don't
change loop device under exclusive opener") alongside commit ecbe6bc0
("block: use bd_prepare_to_claim directly in the loop driver").

Reported-by: default avatar <syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397


Tested-by: default avatar <syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com>
Tested-by: default avatarYongpeng Yang <yangyongpeng@xiaomi.com>
Signed-off-by: default avatarRaphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 69153e8b

drivers/block/loop.c

+30 −11
Original line number Diff line number Diff line
@@ -1225,13 +1225,24 @@ static int loop_clr_fd(struct loop_device *lo) 
}



static int

loop_set_status(struct loop_device *lo, const struct loop_info64 *info)

loop_set_status(struct loop_device *lo, blk_mode_t mode,

		struct block_device *bdev, const struct loop_info64 *info)

{

	int err;

	bool partscan = false;

	bool size_changed = false;

	unsigned int memflags;



	/*

	 * If we don't hold exclusive handle for the device, upgrade to it

	 * here to avoid changing device under exclusive owner.

	 */

	if (!(mode & BLK_OPEN_EXCL)) {

		err = bd_prepare_to_claim(bdev, loop_set_status, NULL);

		if (err)

			goto out_reread_partitions;

	}



	err = mutex_lock_killable(&lo->lo_mutex);

	if (err)

		return err;
@@ -1273,6 +1284,9 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) 
	}

out_unlock:

	mutex_unlock(&lo->lo_mutex);

	if (!(mode & BLK_OPEN_EXCL))

		bd_abort_claiming(bdev, loop_set_status);

out_reread_partitions:

	if (partscan)

		loop_reread_partitions(lo);
@@ -1352,7 +1366,9 @@ loop_info64_to_old(const struct loop_info64 *info64, struct loop_info *info) 
}



static int

loop_set_status_old(struct loop_device *lo, const struct loop_info __user *arg)

loop_set_status_old(struct loop_device *lo, blk_mode_t mode,

		    struct block_device *bdev,

		    const struct loop_info __user *arg)

{

	struct loop_info info;

	struct loop_info64 info64;
@@ -1360,17 +1376,19 @@ loop_set_status_old(struct loop_device *lo, const struct loop_info __user *arg) 
	if (copy_from_user(&info, arg, sizeof (struct loop_info)))

		return -EFAULT;

	loop_info64_from_old(&info, &info64);

	return loop_set_status(lo, &info64);

	return loop_set_status(lo, mode, bdev, &info64);

}



static int

loop_set_status64(struct loop_device *lo, const struct loop_info64 __user *arg)

loop_set_status64(struct loop_device *lo, blk_mode_t mode,

		  struct block_device *bdev,

		  const struct loop_info64 __user *arg)

{

	struct loop_info64 info64;



	if (copy_from_user(&info64, arg, sizeof (struct loop_info64)))

		return -EFAULT;

	return loop_set_status(lo, &info64);

	return loop_set_status(lo, mode, bdev, &info64);

}



static int
@@ -1549,14 +1567,14 @@ static int lo_ioctl(struct block_device *bdev, blk_mode_t mode, 
	case LOOP_SET_STATUS:

		err = -EPERM;

		if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN))

			err = loop_set_status_old(lo, argp);

			err = loop_set_status_old(lo, mode, bdev, argp);

		break;

	case LOOP_GET_STATUS:

		return loop_get_status_old(lo, argp);

	case LOOP_SET_STATUS64:

		err = -EPERM;

		if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN))

			err = loop_set_status64(lo, argp);

			err = loop_set_status64(lo, mode, bdev, argp);

		break;

	case LOOP_GET_STATUS64:

		return loop_get_status64(lo, argp);
@@ -1650,7 +1668,8 @@ loop_info64_to_compat(const struct loop_info64 *info64, 
}



static int

loop_set_status_compat(struct loop_device *lo,

loop_set_status_compat(struct loop_device *lo, blk_mode_t mode,

		    struct block_device *bdev,

		    const struct compat_loop_info __user *arg)

{

	struct loop_info64 info64;
@@ -1659,7 +1678,7 @@ loop_set_status_compat(struct loop_device *lo, 
	ret = loop_info64_from_compat(arg, &info64);

	if (ret < 0)

		return ret;

	return loop_set_status(lo, &info64);

	return loop_set_status(lo, mode, bdev, &info64);

}



static int
@@ -1685,7 +1704,7 @@ static int lo_compat_ioctl(struct block_device *bdev, blk_mode_t mode, 


	switch(cmd) {

	case LOOP_SET_STATUS:

		err = loop_set_status_compat(lo,

		err = loop_set_status_compat(lo, mode, bdev,

			     (const struct compat_loop_info __user *)arg);

		break;

	case LOOP_GET_STATUS: