• Jan Kara's avatar
    loop: Don't change loop device under exclusive opener · 33ec3e53
    Jan Kara authored
    Loop module allows calling LOOP_SET_FD while there are other openers of
    the loop device. Even exclusive ones. This can lead to weird
    consequences such as kernel deadlocks like:
    
    mount_bdev()				lo_ioctl()
      udf_fill_super()
        udf_load_vrs()
          sb_set_blocksize() - sets desired block size B
          udf_tread()
            sb_bread()
              __bread_gfp(bdev, block, B)
    					  loop_set_fd()
    					    set_blocksize()
                - now __getblk_slow() indefinitely loops because B != bdev
                  block size
    
    Fix the problem by disallowing LOOP_SET_FD ioctl when there are
    exclusive openers of a loop device.
    
    [Deliberately chosen not to CC stable as a user with priviledges to
    trigger this race has other means of taking the system down and this
    has a potential of breaking some weird userspace setup]
    
    Reported-and-tested-by: syzbot+10007d66ca02b08f0e60@syzkaller.appspotmail.com
    Signed-off-by: default avatarJan Kara <jack@suse.cz>
    Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
    33ec3e53
loop.c 56.4 KB