releases/4.4.172/block-loop-use-global-lock-for-ioctl-operation.patch

   1 From 310ca162d779efee8a2dc3731439680f3e9c1e86 Mon Sep 17 00:00:00 2001
   2 From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
   3 Date: Thu, 8 Nov 2018 14:01:02 +0100
   4 Subject: block/loop: Use global lock for ioctl() operation.
   5
   6 From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
   7
   8 commit 310ca162d779efee8a2dc3731439680f3e9c1e86 upstream.
   9
  10 syzbot is reporting NULL pointer dereference [1] which is caused by
  11 race condition between ioctl(loop_fd, LOOP_CLR_FD, 0) versus
  12 ioctl(other_loop_fd, LOOP_SET_FD, loop_fd) due to traversing other
  13 loop devices at loop_validate_file() without holding corresponding
  14 lo->lo_ctl_mutex locks.
  15
  16 Since ioctl() request on loop devices is not frequent operation, we don't
  17 need fine grained locking. Let's use global lock in order to allow safe
  18 traversal at loop_validate_file().
  19
  20 Note that syzbot is also reporting circular locking dependency between
  21 bdev->bd_mutex and lo->lo_ctl_mutex [2] which is caused by calling
  22 blkdev_reread_part() with lock held. This patch does not address it.
  23
  24 [1] https://syzkaller.appspot.com/bug?id=f3cfe26e785d85f9ee259f385515291d21bd80a3
  25 [2] https://syzkaller.appspot.com/bug?id=bf154052f0eea4bc7712499e4569505907d15889
  26
  27 Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
  28 Reported-by: syzbot <syzbot+bf89c128e05dd6c62523@syzkaller.appspotmail.com>
  29 Reviewed-by: Jan Kara <jack@suse.cz>
  30 Signed-off-by: Jan Kara <jack@suse.cz>
  31 Signed-off-by: Jens Axboe <axboe@kernel.dk>
  32 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  33
  34 ---
  35  drivers/block/loop.c |   42 +++++++++++++++++++++---------------------
  36  drivers/block/loop.h |    1 -
  37  2 files changed, 21 insertions(+), 22 deletions(-)
  38
  39 --- a/drivers/block/loop.c
  40 +++ b/drivers/block/loop.c
  41 @@ -82,6 +82,7 @@
  42
  43  static DEFINE_IDR(loop_index_idr);
  44  static DEFINE_MUTEX(loop_index_mutex);
  45 +static DEFINE_MUTEX(loop_ctl_mutex);
  46
  47  static int max_part;
  48  static int part_shift;
  49 @@ -1044,7 +1045,7 @@ static int loop_clr_fd(struct loop_devic
  50          */
  51         if (atomic_read(&lo->lo_refcnt) > 1) {
  52                 lo->lo_flags |= LO_FLAGS_AUTOCLEAR;
  53 -               mutex_unlock(&lo->lo_ctl_mutex);
  54 +               mutex_unlock(&loop_ctl_mutex);
  55                 return 0;
  56         }
  57
  58 @@ -1093,12 +1094,12 @@ static int loop_clr_fd(struct loop_devic
  59         if (!part_shift)
  60                 lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN;
  61         loop_unprepare_queue(lo);
  62 -       mutex_unlock(&lo->lo_ctl_mutex);
  63 +       mutex_unlock(&loop_ctl_mutex);
  64         /*
  65 -        * Need not hold lo_ctl_mutex to fput backing file.
  66 -        * Calling fput holding lo_ctl_mutex triggers a circular
  67 +        * Need not hold loop_ctl_mutex to fput backing file.
  68 +        * Calling fput holding loop_ctl_mutex triggers a circular
  69          * lock dependency possibility warning as fput can take
  70 -        * bd_mutex which is usually taken before lo_ctl_mutex.
  71 +        * bd_mutex which is usually taken before loop_ctl_mutex.
  72          */
  73         fput(filp);
  74         return 0;
  75 @@ -1361,7 +1362,7 @@ static int lo_ioctl(struct block_device
  76         struct loop_device *lo = bdev->bd_disk->private_data;
  77         int err;
  78
  79 -       mutex_lock_nested(&lo->lo_ctl_mutex, 1);
  80 +       mutex_lock_nested(&loop_ctl_mutex, 1);
  81         switch (cmd) {
  82         case LOOP_SET_FD:
  83                 err = loop_set_fd(lo, mode, bdev, arg);
  84 @@ -1370,7 +1371,7 @@ static int lo_ioctl(struct block_device
  85                 err = loop_change_fd(lo, bdev, arg);
  86                 break;
  87         case LOOP_CLR_FD:
  88 -               /* loop_clr_fd would have unlocked lo_ctl_mutex on success */
  89 +               /* loop_clr_fd would have unlocked loop_ctl_mutex on success */
  90                 err = loop_clr_fd(lo);
  91                 if (!err)
  92                         goto out_unlocked;
  93 @@ -1406,7 +1407,7 @@ static int lo_ioctl(struct block_device
  94         default:
  95                 err = lo->ioctl ? lo->ioctl(lo, cmd, arg) : -EINVAL;
  96         }
  97 -       mutex_unlock(&lo->lo_ctl_mutex);
  98 +       mutex_unlock(&loop_ctl_mutex);
  99
 100  out_unlocked:
 101         return err;
 102 @@ -1539,16 +1540,16 @@ static int lo_compat_ioctl(struct block_
 103
 104         switch(cmd) {
 105         case LOOP_SET_STATUS:
 106 -               mutex_lock(&lo->lo_ctl_mutex);
 107 +               mutex_lock(&loop_ctl_mutex);
 108                 err = loop_set_status_compat(
 109                         lo, (const struct compat_loop_info __user *) arg);
 110 -               mutex_unlock(&lo->lo_ctl_mutex);
 111 +               mutex_unlock(&loop_ctl_mutex);
 112                 break;
 113         case LOOP_GET_STATUS:
 114 -               mutex_lock(&lo->lo_ctl_mutex);
 115 +               mutex_lock(&loop_ctl_mutex);
 116                 err = loop_get_status_compat(
 117                         lo, (struct compat_loop_info __user *) arg);
 118 -               mutex_unlock(&lo->lo_ctl_mutex);
 119 +               mutex_unlock(&loop_ctl_mutex);
 120                 break;
 121         case LOOP_SET_CAPACITY:
 122         case LOOP_CLR_FD:
 123 @@ -1592,7 +1593,7 @@ static void __lo_release(struct loop_dev
 124         if (atomic_dec_return(&lo->lo_refcnt))
 125                 return;
 126
 127 -       mutex_lock(&lo->lo_ctl_mutex);
 128 +       mutex_lock(&loop_ctl_mutex);
 129         if (lo->lo_flags & LO_FLAGS_AUTOCLEAR) {
 130                 /*
 131                  * In autoclear mode, stop the loop thread
 132 @@ -1609,7 +1610,7 @@ static void __lo_release(struct loop_dev
 133                 loop_flush(lo);
 134         }
 135
 136 -       mutex_unlock(&lo->lo_ctl_mutex);
 137 +       mutex_unlock(&loop_ctl_mutex);
 138  }
 139
 140  static void lo_release(struct gendisk *disk, fmode_t mode)
 141 @@ -1655,10 +1656,10 @@ static int unregister_transfer_cb(int id
 142         struct loop_device *lo = ptr;
 143         struct loop_func_table *xfer = data;
 144
 145 -       mutex_lock(&lo->lo_ctl_mutex);
 146 +       mutex_lock(&loop_ctl_mutex);
 147         if (lo->lo_encryption == xfer)
 148                 loop_release_xfer(lo);
 149 -       mutex_unlock(&lo->lo_ctl_mutex);
 150 +       mutex_unlock(&loop_ctl_mutex);
 151         return 0;
 152  }
 153
 154 @@ -1820,7 +1821,6 @@ static int loop_add(struct loop_device *
 155         if (!part_shift)
 156                 disk->flags |= GENHD_FL_NO_PART_SCAN;
 157         disk->flags |= GENHD_FL_EXT_DEVT;
 158 -       mutex_init(&lo->lo_ctl_mutex);
 159         atomic_set(&lo->lo_refcnt, 0);
 160         lo->lo_number           = i;
 161         spin_lock_init(&lo->lo_lock);
 162 @@ -1933,19 +1933,19 @@ static long loop_control_ioctl(struct fi
 163                 ret = loop_lookup(&lo, parm);
 164                 if (ret < 0)
 165                         break;
 166 -               mutex_lock(&lo->lo_ctl_mutex);
 167 +               mutex_lock(&loop_ctl_mutex);
 168                 if (lo->lo_state != Lo_unbound) {
 169                         ret = -EBUSY;
 170 -                       mutex_unlock(&lo->lo_ctl_mutex);
 171 +                       mutex_unlock(&loop_ctl_mutex);
 172                         break;
 173                 }
 174                 if (atomic_read(&lo->lo_refcnt) > 0) {
 175                         ret = -EBUSY;
 176 -                       mutex_unlock(&lo->lo_ctl_mutex);
 177 +                       mutex_unlock(&loop_ctl_mutex);
 178                         break;
 179                 }
 180                 lo->lo_disk->private_data = NULL;
 181 -               mutex_unlock(&lo->lo_ctl_mutex);
 182 +               mutex_unlock(&loop_ctl_mutex);
 183                 idr_remove(&loop_index_idr, lo->lo_number);
 184                 loop_remove(lo);
 185                 break;
 186 --- a/drivers/block/loop.h
 187 +++ b/drivers/block/loop.h
 188 @@ -55,7 +55,6 @@ struct loop_device {
 189
 190         spinlock_t              lo_lock;
 191         int                     lo_state;
 192 -       struct mutex            lo_ctl_mutex;
 193         struct kthread_worker   worker;
 194         struct task_struct      *worker_task;
 195         bool                    use_dio;