loop: don't change loop device under exclusive opener in loop_set_status

loop_set_status() is allowed to change the loop device while there
are other openers of the device, even exclusive ones.

In this case, it causes a KASAN: slab-out-of-bounds Read in
ext4_search_dir(), since when looking for an entry in an inlined
directory, e_value_offs is changed underneath the filesystem by
loop_set_status().

Fix the problem by forbidding loop_set_status() from modifying the loop
device while there are exclusive openers of the device. This is similar
to the fix in loop_configure() by commit 33ec3e53e7b1 ("loop: Don't
change loop device under exclusive opener") alongside commit ecbe6bc0003b
("block: use bd_prepare_to_claim directly in the loop driver").

Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Tested-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Tested-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 32a3a5b138029e65e97f331fb64577ceedbdf59c..ca74cc31bf07ffe5386d4074c0070898b3e1290f 100644 (file)
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1225,13 +1225,24 @@ static int loop_clr_fd(struct loop_device *lo)
 }
 
 static int
-loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
+loop_set_status(struct loop_device *lo, blk_mode_t mode,
+               struct block_device *bdev, const struct loop_info64 *info)
 {
        int err;
        bool partscan = false;
        bool size_changed = false;
        unsigned int memflags;
 
+       /*
+        * If we don't hold exclusive handle for the device, upgrade to it
+        * here to avoid changing device under exclusive owner.
+        */
+       if (!(mode & BLK_OPEN_EXCL)) {
+               err = bd_prepare_to_claim(bdev, loop_set_status, NULL);
+               if (err)
+                       goto out_reread_partitions;
+       }
+
        err = mutex_lock_killable(&lo->lo_mutex);
        if (err)
                return err;
@@ -1273,6 +1284,9 @@ out_unfreeze:
        }
 out_unlock:
        mutex_unlock(&lo->lo_mutex);
+       if (!(mode & BLK_OPEN_EXCL))
+               bd_abort_claiming(bdev, loop_set_status);
+out_reread_partitions:
        if (partscan)
                loop_reread_partitions(lo);
 
@@ -1352,7 +1366,9 @@ loop_info64_to_old(const struct loop_info64 *info64, struct loop_info *info)
 }
 
 static int
-loop_set_status_old(struct loop_device *lo, const struct loop_info __user *arg)
+loop_set_status_old(struct loop_device *lo, blk_mode_t mode,
+                   struct block_device *bdev,
+                   const struct loop_info __user *arg)
 {
        struct loop_info info;
        struct loop_info64 info64;
@@ -1360,17 +1376,19 @@ loop_set_status_old(struct loop_device *lo, const struct loop_info __user *arg)
        if (copy_from_user(&info, arg, sizeof (struct loop_info)))
                return -EFAULT;
        loop_info64_from_old(&info, &info64);
-       return loop_set_status(lo, &info64);
+       return loop_set_status(lo, mode, bdev, &info64);
 }
 
 static int
-loop_set_status64(struct loop_device *lo, const struct loop_info64 __user *arg)
+loop_set_status64(struct loop_device *lo, blk_mode_t mode,
+                 struct block_device *bdev,
+                 const struct loop_info64 __user *arg)
 {
        struct loop_info64 info64;
 
        if (copy_from_user(&info64, arg, sizeof (struct loop_info64)))
                return -EFAULT;
-       return loop_set_status(lo, &info64);
+       return loop_set_status(lo, mode, bdev, &info64);
 }
 
 static int
@@ -1549,14 +1567,14 @@ static int lo_ioctl(struct block_device *bdev, blk_mode_t mode,
        case LOOP_SET_STATUS:
                err = -EPERM;
                if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN))
-                       err = loop_set_status_old(lo, argp);
+                       err = loop_set_status_old(lo, mode, bdev, argp);
                break;
        case LOOP_GET_STATUS:
                return loop_get_status_old(lo, argp);
        case LOOP_SET_STATUS64:
                err = -EPERM;
                if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN))
-                       err = loop_set_status64(lo, argp);
+                       err = loop_set_status64(lo, mode, bdev, argp);
                break;
        case LOOP_GET_STATUS64:
                return loop_get_status64(lo, argp);
@@ -1650,8 +1668,9 @@ loop_info64_to_compat(const struct loop_info64 *info64,
 }
 
 static int
-loop_set_status_compat(struct loop_device *lo,
-                      const struct compat_loop_info __user *arg)
+loop_set_status_compat(struct loop_device *lo, blk_mode_t mode,
+                   struct block_device *bdev,
+                   const struct compat_loop_info __user *arg)
 {
        struct loop_info64 info64;
        int ret;
@@ -1659,7 +1678,7 @@ loop_set_status_compat(struct loop_device *lo,
        ret = loop_info64_from_compat(arg, &info64);
        if (ret < 0)
                return ret;
-       return loop_set_status(lo, &info64);
+       return loop_set_status(lo, mode, bdev, &info64);
 }
 
 static int
@@ -1685,7 +1704,7 @@ static int lo_compat_ioctl(struct block_device *bdev, blk_mode_t mode,
 
        switch(cmd) {
        case LOOP_SET_STATUS:
-               err = loop_set_status_compat(lo,
+               err = loop_set_status_compat(lo, mode, bdev,
                             (const struct compat_loop_info __user *)arg);
                break;
        case LOOP_GET_STATUS: