From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+4349872271ece473a7c91190b68b4bac7c5dbc87@syzkaller.appspotmail.com,
syzbot+40bd32c4d9a3cc12a339@syzkaller.appspotmail.com,
syzbot+769c54e66f994b041be7@syzkaller.appspotmail.com,
syzbot+0a89a9ce473936c57065@syzkaller.appspotmail.com,
Theodore Tso <tytso@mit.edu>, Jens Axboe <axboe@kernel.dk>
Subject: [PATCH 4.14 50/54] loop: add recursion validation to LOOP_CHANGE_FD
Date: Mon, 16 Jul 2018 09:35:47 +0200 [thread overview]
Message-ID: <20180716073459.879630268@linuxfoundation.org> (raw)
In-Reply-To: <20180716073450.534886211@linuxfoundation.org>
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit d2ac838e4cd7e5e9891ecc094d626734b0245c99 upstream.
Refactor the validation code used in LOOP_SET_FD so it is also used in
LOOP_CHANGE_FD. Otherwise it is possible to construct a set of loop
devices that all refer to each other. This can lead to a infinite
loop in starting with "while (is_loop_device(f)) .." in loop_set_fd().
Fix this by refactoring out the validation code and using it for
LOOP_CHANGE_FD as well as LOOP_SET_FD.
Reported-by: syzbot+4349872271ece473a7c91190b68b4bac7c5dbc87@syzkaller.appspotmail.com
Reported-by: syzbot+40bd32c4d9a3cc12a339@syzkaller.appspotmail.com
Reported-by: syzbot+769c54e66f994b041be7@syzkaller.appspotmail.com
Reported-by: syzbot+0a89a9ce473936c57065@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/loop.c | 68 ++++++++++++++++++++++++++++-----------------------
1 file changed, 38 insertions(+), 30 deletions(-)
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -617,6 +617,36 @@ static void loop_reread_partitions(struc
__func__, lo->lo_number, lo->lo_file_name, rc);
}
+static inline int is_loop_device(struct file *file)
+{
+ struct inode *i = file->f_mapping->host;
+
+ return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR;
+}
+
+static int loop_validate_file(struct file *file, struct block_device *bdev)
+{
+ struct inode *inode = file->f_mapping->host;
+ struct file *f = file;
+
+ /* Avoid recursion */
+ while (is_loop_device(f)) {
+ struct loop_device *l;
+
+ if (f->f_mapping->host->i_bdev == bdev)
+ return -EBADF;
+
+ l = f->f_mapping->host->i_bdev->bd_disk->private_data;
+ if (l->lo_state == Lo_unbound) {
+ return -EINVAL;
+ }
+ f = l->lo_backing_file;
+ }
+ if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
+ return -EINVAL;
+ return 0;
+}
+
/*
* loop_change_fd switched the backing store of a loopback device to
* a new file. This is useful for operating system installers to free up
@@ -646,14 +676,15 @@ static int loop_change_fd(struct loop_de
if (!file)
goto out;
+ error = loop_validate_file(file, bdev);
+ if (error)
+ goto out_putf;
+
inode = file->f_mapping->host;
old_file = lo->lo_backing_file;
error = -EINVAL;
- if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
- goto out_putf;
-
/* size of the new backing store needs to be the same */
if (get_loop_size(lo, file) != get_loop_size(lo, old_file))
goto out_putf;
@@ -679,13 +710,6 @@ static int loop_change_fd(struct loop_de
return error;
}
-static inline int is_loop_device(struct file *file)
-{
- struct inode *i = file->f_mapping->host;
-
- return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR;
-}
-
/* loop sysfs attributes */
static ssize_t loop_attr_show(struct device *dev, char *page,
@@ -850,7 +874,7 @@ static int loop_prepare_queue(struct loo
static int loop_set_fd(struct loop_device *lo, fmode_t mode,
struct block_device *bdev, unsigned int arg)
{
- struct file *file, *f;
+ struct file *file;
struct inode *inode;
struct address_space *mapping;
int lo_flags = 0;
@@ -869,29 +893,13 @@ static int loop_set_fd(struct loop_devic
if (lo->lo_state != Lo_unbound)
goto out_putf;
- /* Avoid recursion */
- f = file;
- while (is_loop_device(f)) {
- struct loop_device *l;
-
- if (f->f_mapping->host->i_bdev == bdev)
- goto out_putf;
-
- l = f->f_mapping->host->i_bdev->bd_disk->private_data;
- if (l->lo_state == Lo_unbound) {
- error = -EINVAL;
- goto out_putf;
- }
- f = l->lo_backing_file;
- }
+ error = loop_validate_file(file, bdev);
+ if (error)
+ goto out_putf;
mapping = file->f_mapping;
inode = mapping->host;
- error = -EINVAL;
- if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
- goto out_putf;
-
if (!(file->f_mode & FMODE_WRITE) || !(mode & FMODE_WRITE) ||
!file->f_op->write_iter)
lo_flags |= LO_FLAGS_READ_ONLY;
next prev parent reply other threads:[~2018-07-16 7:42 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-16 7:34 [PATCH 4.14 00/54] 4.14.56-stable review Greg Kroah-Hartman
2018-07-16 7:34 ` [PATCH 4.14 01/54] media: rc: mce_kbd decoder: fix stuck keys Greg Kroah-Hartman
2018-07-16 7:34 ` [PATCH 4.14 02/54] ASoC: mediatek: preallocate pages use platform device Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 03/54] MIPS: Call dump_stack() from show_regs() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 04/54] MIPS: Use async IPIs for arch_trigger_cpumask_backtrace() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 05/54] MIPS: Fix ioremap() RAM check Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 06/54] mmc: sdhci-esdhc-imx: allow 1.8V modes without 100/200MHz pinctrl states Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 07/54] mmc: dw_mmc: fix card threshold control configuration Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 08/54] ibmasm: dont write out of bounds in read handler Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 09/54] staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 10/54] staging: r8822be: Fix RTL8822be cant find any wireless AP Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 11/54] ata: Fix ZBC_OUT command block check Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 12/54] ata: Fix ZBC_OUT all bit handling Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 13/54] vmw_balloon: fix inflation with batching Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 14/54] ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 15/54] USB: serial: ch341: fix type promotion bug in ch341_control_in() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 16/54] USB: serial: cp210x: add another USB ID for Qivicon ZigBee stick Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 17/54] USB: serial: keyspan_pda: fix modem-status error handling Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 18/54] USB: yurex: fix out-of-bounds uaccess in read handler Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 19/54] USB: serial: mos7840: fix status-register error handling Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 20/54] usb: quirks: add delay quirks for Corsair Strafe Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 21/54] xhci: xhci-mem: off by one in xhci_stream_id_to_ring() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 22/54] devpts: hoist out check for DEVPTS_SUPER_MAGIC Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 23/54] devpts: resolve devpts bind-mounts Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 24/54] Fix up non-directory creation in SGID directories Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 25/54] genirq/affinity: assign vectors to all possible CPUs Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 26/54] scsi: megaraid_sas: use adapter_type for all gen controllers Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 27/54] scsi: megaraid_sas: replace instance->ctrl_context checks with instance->adapter_type Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 28/54] scsi: megaraid_sas: replace is_ventura with adapter_type checks Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 29/54] scsi: megaraid_sas: Create separate functions to allocate ctrl memory Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 30/54] scsi: megaraid_sas: fix selection of reply queue Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 31/54] ALSA: hda/realtek - two more lenovo models need fixup of MIC_LOCATION Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 32/54] ALSA: hda - Handle pm failure during hotplug Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 33/54] mm: do not drop unused pages when userfaultd is running Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 34/54] fs/proc/task_mmu.c: fix Locked field in /proc/pid/smaps* Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 35/54] fs, elf: make sure to page align bss in load_elf_library Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 36/54] mm: do not bug_on on incorrect length in __mm_populate() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 37/54] tracing: Reorder display of TGID to be after PID Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 38/54] kbuild: delete INSTALL_FW_PATH from kbuild documentation Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 39/54] arm64: neon: Fix function may_use_simd() return error status Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 40/54] tools build: fix # escaping in .cmd files for future Make Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 41/54] IB/hfi1: Fix incorrect mixing of ERR_PTR and NULL return values Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 42/54] i2c: tegra: Fix NACK error handling Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 43/54] iw_cxgb4: correctly enforce the max reg_mr depth Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 44/54] xen: setup pv irq ops vector earlier Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 45/54] nvme-pci: Remap CMB SQ entries on every controller reset Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 46/54] crypto: x86/salsa20 - remove x86 salsa20 implementations Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 47/54] uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 48/54] netfilter: nf_queue: augment nfqa_cfg_policy Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 49/54] netfilter: x_tables: initialise match/target check parameter struct Greg Kroah-Hartman
2018-07-16 7:35 ` Greg Kroah-Hartman [this message]
2018-07-16 7:35 ` [PATCH 4.14 51/54] PM / hibernate: Fix oops at snapshot_write() Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 52/54] RDMA/ucm: Mark UCM interface as BROKEN Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 53/54] loop: remember whether sysfs_create_group() was done Greg Kroah-Hartman
2018-07-16 7:35 ` [PATCH 4.14 54/54] f2fs: give message and set need_fsck given broken node id Greg Kroah-Hartman
2018-07-16 16:26 ` [PATCH 4.14 00/54] 4.14.56-stable review Guenter Roeck
2018-07-17 8:04 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180716073459.879630268@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=axboe@kernel.dk \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+0a89a9ce473936c57065@syzkaller.appspotmail.com \
--cc=syzbot+40bd32c4d9a3cc12a339@syzkaller.appspotmail.com \
--cc=syzbot+4349872271ece473a7c91190b68b4bac7c5dbc87@syzkaller.appspotmail.com \
--cc=syzbot+769c54e66f994b041be7@syzkaller.appspotmail.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).