From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+4349872271ece473a7c91190b68b4bac7c5dbc87@syzkaller.appspotmail.com,
syzbot+40bd32c4d9a3cc12a339@syzkaller.appspotmail.com,
syzbot+769c54e66f994b041be7@syzkaller.appspotmail.com,
syzbot+0a89a9ce473936c57065@syzkaller.appspotmail.com,
Theodore Tso <tytso@mit.edu>, Jens Axboe <axboe@kernel.dk>
Subject: [PATCH 4.4 40/43] loop: add recursion validation to LOOP_CHANGE_FD
Date: Mon, 16 Jul 2018 09:36:45 +0200 [thread overview]
Message-ID: <20180716073516.296730239@linuxfoundation.org> (raw)
In-Reply-To: <20180716073511.796555857@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit d2ac838e4cd7e5e9891ecc094d626734b0245c99 upstream.
Refactor the validation code used in LOOP_SET_FD so it is also used in
LOOP_CHANGE_FD. Otherwise it is possible to construct a set of loop
devices that all refer to each other. This can lead to a infinite
loop in starting with "while (is_loop_device(f)) .." in loop_set_fd().
Fix this by refactoring out the validation code and using it for
LOOP_CHANGE_FD as well as LOOP_SET_FD.
Reported-by: syzbot+4349872271ece473a7c91190b68b4bac7c5dbc87@syzkaller.appspotmail.com
Reported-by: syzbot+40bd32c4d9a3cc12a339@syzkaller.appspotmail.com
Reported-by: syzbot+769c54e66f994b041be7@syzkaller.appspotmail.com
Reported-by: syzbot+0a89a9ce473936c57065@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/loop.c | 68 ++++++++++++++++++++++++++++-----------------------
1 file changed, 38 insertions(+), 30 deletions(-)
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -651,6 +651,36 @@ static void loop_reread_partitions(struc
__func__, lo->lo_number, lo->lo_file_name, rc);
}
+static inline int is_loop_device(struct file *file)
+{
+ struct inode *i = file->f_mapping->host;
+
+ return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR;
+}
+
+static int loop_validate_file(struct file *file, struct block_device *bdev)
+{
+ struct inode *inode = file->f_mapping->host;
+ struct file *f = file;
+
+ /* Avoid recursion */
+ while (is_loop_device(f)) {
+ struct loop_device *l;
+
+ if (f->f_mapping->host->i_bdev == bdev)
+ return -EBADF;
+
+ l = f->f_mapping->host->i_bdev->bd_disk->private_data;
+ if (l->lo_state == Lo_unbound) {
+ return -EINVAL;
+ }
+ f = l->lo_backing_file;
+ }
+ if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
+ return -EINVAL;
+ return 0;
+}
+
/*
* loop_change_fd switched the backing store of a loopback device to
* a new file. This is useful for operating system installers to free up
@@ -680,14 +710,15 @@ static int loop_change_fd(struct loop_de
if (!file)
goto out;
+ error = loop_validate_file(file, bdev);
+ if (error)
+ goto out_putf;
+
inode = file->f_mapping->host;
old_file = lo->lo_backing_file;
error = -EINVAL;
- if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
- goto out_putf;
-
/* size of the new backing store needs to be the same */
if (get_loop_size(lo, file) != get_loop_size(lo, old_file))
goto out_putf;
@@ -708,13 +739,6 @@ static int loop_change_fd(struct loop_de
return error;
}
-static inline int is_loop_device(struct file *file)
-{
- struct inode *i = file->f_mapping->host;
-
- return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR;
-}
-
/* loop sysfs attributes */
static ssize_t loop_attr_show(struct device *dev, char *page,
@@ -872,7 +896,7 @@ static int loop_prepare_queue(struct loo
static int loop_set_fd(struct loop_device *lo, fmode_t mode,
struct block_device *bdev, unsigned int arg)
{
- struct file *file, *f;
+ struct file *file;
struct inode *inode;
struct address_space *mapping;
unsigned lo_blocksize;
@@ -892,29 +916,13 @@ static int loop_set_fd(struct loop_devic
if (lo->lo_state != Lo_unbound)
goto out_putf;
- /* Avoid recursion */
- f = file;
- while (is_loop_device(f)) {
- struct loop_device *l;
-
- if (f->f_mapping->host->i_bdev == bdev)
- goto out_putf;
-
- l = f->f_mapping->host->i_bdev->bd_disk->private_data;
- if (l->lo_state == Lo_unbound) {
- error = -EINVAL;
- goto out_putf;
- }
- f = l->lo_backing_file;
- }
+ error = loop_validate_file(file, bdev);
+ if (error)
+ goto out_putf;
mapping = file->f_mapping;
inode = mapping->host;
- error = -EINVAL;
- if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
- goto out_putf;
-
if (!(file->f_mode & FMODE_WRITE) || !(mode & FMODE_WRITE) ||
!file->f_op->write_iter)
lo_flags |= LO_FLAGS_READ_ONLY;
next prev parent reply other threads:[~2018-07-16 7:45 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-16 7:36 [PATCH 4.4 00/43] 4.4.141-stable review Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 01/43] MIPS: Fix ioremap() RAM check Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 02/43] ibmasm: dont write out of bounds in read handler Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 03/43] vmw_balloon: fix inflation with batching Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 04/43] ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 05/43] USB: serial: ch341: fix type promotion bug in ch341_control_in() Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 06/43] USB: serial: cp210x: add another USB ID for Qivicon ZigBee stick Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 07/43] USB: serial: keyspan_pda: fix modem-status error handling Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 08/43] USB: yurex: fix out-of-bounds uaccess in read handler Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 09/43] USB: serial: mos7840: fix status-register error handling Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 10/43] usb: quirks: add delay quirks for Corsair Strafe Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 11/43] xhci: xhci-mem: off by one in xhci_stream_id_to_ring() Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 12/43] HID: usbhid: add quirk for innomedia INNEX GENESIS/ATARI adapter Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 13/43] Fix up non-directory creation in SGID directories Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 14/43] tools build: fix # escaping in .cmd files for future Make Greg Kroah-Hartman
2018-07-17 12:57 ` Konstantin Khlebnikov
2018-07-17 13:10 ` Greg Kroah-Hartman
2018-07-17 13:15 ` Greg Kroah-Hartman
2018-07-17 19:51 ` Konstantin Khlebnikov
2018-07-18 8:24 ` Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 15/43] iw_cxgb4: correctly enforce the max reg_mr depth Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 16/43] x86/cpufeature: Move some of the scattered feature bits to x86_capability Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 17/43] x86/cpufeature: Cleanup get_cpu_cap() Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 18/43] x86/cpu: Provide a config option to disable static_cpu_has Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 19/43] x86/fpu: Add an XSTATE_OP() macro Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 20/43] x86/fpu: Get rid of xstate_fault() Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 21/43] x86/headers: Dont include asm/processor.h in asm/atomic.h Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 22/43] x86/cpufeature: Carve out X86_FEATURE_* Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 23/43] x86/cpufeature: Replace the old static_cpu_has() with safe variant Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 24/43] x86/cpufeature: Get rid of the non-asm goto variant Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 25/43] x86/alternatives: Add an auxilary section Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 26/43] x86/alternatives: Discard dynamic check after init Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 27/43] x86/vdso: Use static_cpu_has() Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 28/43] x86/boot: Simplify kernel load address alignment check Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 29/43] x86/cpufeature: Speed up cpu_feature_enabled() Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 30/43] x86/cpufeature, x86/mm/pkeys: Add protection keys related CPUID definitions Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 31/43] x86/mm/pkeys: Fix mismerge of protection keys CPUID bits Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 32/43] x86/cpu: Add detection of AMD RAS Capabilities Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 33/43] x86/cpufeature, x86/mm/pkeys: Fix broken compile-time disabling of pkeys Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 34/43] x86/cpufeature: Update cpufeaure macros Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 35/43] x86/cpufeature: Make sure DISABLED/REQUIRED macros are updated Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 36/43] x86/cpufeature: Add helper macro for mask check macros Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 37/43] uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn() Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 38/43] netfilter: nf_queue: augment nfqa_cfg_policy Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 39/43] netfilter: x_tables: initialise match/target check parameter struct Greg Kroah-Hartman
2018-07-16 7:36 ` Greg Kroah-Hartman [this message]
2018-08-22 21:43 ` [PATCH 4.4 40/43] loop: add recursion validation to LOOP_CHANGE_FD Ben Hutchings
2018-07-16 7:36 ` [PATCH 4.4 41/43] PM / hibernate: Fix oops at snapshot_write() Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 42/43] RDMA/ucm: Mark UCM interface as BROKEN Greg Kroah-Hartman
2018-07-16 7:36 ` [PATCH 4.4 43/43] loop: remember whether sysfs_create_group() was done Greg Kroah-Hartman
2018-07-16 13:55 ` [PATCH 4.4 00/43] 4.4.141-stable review Nathan Chancellor
2018-07-16 16:22 ` Guenter Roeck
2018-07-17 8:06 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180716073516.296730239@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=axboe@kernel.dk \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+0a89a9ce473936c57065@syzkaller.appspotmail.com \
--cc=syzbot+40bd32c4d9a3cc12a339@syzkaller.appspotmail.com \
--cc=syzbot+4349872271ece473a7c91190b68b4bac7c5dbc87@syzkaller.appspotmail.com \
--cc=syzbot+769c54e66f994b041be7@syzkaller.appspotmail.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).