linux-stable.git/drivers/block/loop.c, branch linux-4.9.y

loop: Check for overflow while configuring loop

2022-09-05T08:23:56+00:00

commit c490a0b5a4f36da3918181a8acdc6991d967c5f3 upstream.

The userspace can configure a loop using an ioctl call, wherein
a configuration of type loop_config is passed (see lo_ioctl()'s
case on line 1550 of drivers/block/loop.c). This proceeds to call
loop_configure() which in turn calls loop_set_status_from_info()
(see line 1050 of loop.c), passing &config->info which is of type
loop_info64*. This function then sets the appropriate values, like
the offset.

loop_device has lo_offset of type loff_t (see line 52 of loop.c),
which is typdef-chained to long long, whereas loop_info64 has
lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h).

The function directly copies offset from info to the device as
follows (See line 980 of loop.c):
	lo->lo_offset = info->lo_offset;

This results in an overflow, which triggers a warning in iomap_iter()
due to a call to iomap_iter_done() which has:
	WARN_ON_ONCE(iter->iomap.offset > iter->pos);

Thus, check for negative value during loop_set_status_from_info().

Bug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e

Reported-and-tested-by: syzbot+a8e049cd3abd342936b6@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Reviewed-by: Matthew Wilcox (Oracle) 
Signed-off-by: Siddh Raman Pant 
Reviewed-by: Christoph Hellwig 
Link: https://lore.kernel.org/r/20220823160810.181275-1-code@siddh.me
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

loop: use sysfs_emit() in the sysfs xxx show()

2022-04-20T07:06:38+00:00

[ Upstream commit b27824d31f09ea7b4a6ba2c1b18bd328df3e8bed ]

sprintf does not know the PAGE_SIZE maximum of the temporary buffer
used for outputting sysfs content and it's possible to overrun the
PAGE_SIZE buffer length.

Use a generic sysfs_emit function that knows the size of the
temporary buffer and ensures that no overrun is done for offset
attribute in
loop_attr_[offset|sizelimit|autoclear|partscan|dio]_show() callbacks.

Signed-off-by: Chaitanya Kulkarni 
Reviewed-by: Himanshu Madhani 
Link: https://lore.kernel.org/r/20220215213310.7264-2-kch@nvidia.com
Signed-off-by: Jens Axboe 
Signed-off-by: Sasha Levin

loop: Add LOOP_SET_DIRECT_IO to compat ioctl

2019-10-29T08:15:09+00:00

[ Upstream commit fdbe4eeeb1aac219b14f10c0ed31ae5d1123e9b8 ]

Enabling Direct I/O with loop devices helps reducing memory usage by
avoiding double caching.  32 bit applications running on 64 bits systems
are currently not able to request direct I/O because is missing from the
lo_compat_ioctl.

This patch fixes the compatibility issue mentioned above by exporting
LOOP_SET_DIRECT_IO as additional lo_compat_ioctl() entry.
The input argument for this ioctl is a single long converted to a 1-bit
boolean, so compatibility is preserved.

Cc: Jens Axboe 
Signed-off-by: Alessio Balsini 
Signed-off-by: Jens Axboe 
Signed-off-by: Sasha Levin

Revert "block/loop: Use global lock for ioctl() operation."

2019-05-02T07:32:04+00:00

This reverts commit 3ae3d167f5ec2c7bb5fcd12b7772cfadc93b2305 which is
commit 310ca162d779efee8a2dc3731439680f3e9c1e86 upstream.

Jan Kara has reported seeing problems with this patch applied, as has
Salvatore Bonaccorso, so let's drop it for now.

Reported-by: Salvatore Bonaccorso 
Reported-by: Jan Kara 
Cc: Tetsuo Handa 
Cc: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

Revert "loop: Fold __loop_release into loop_release"

2019-03-05T16:57:03+00:00

This reverts commit 7d839c10b848aa66ca1290a21ee600bd17c2dcb4 which is
commit 967d1dc144b50ad005e5eecdfadfbcfb399ffff6 upstream.

It does not work properly in the 4.9.y tree and causes more problems
than it fixes, so revert it.

Reported-by: Thomas Lindroth 
Reported-by: Jan Kara 
Cc: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

Revert "loop: Get rid of loop_index_mutex"

2019-03-05T16:57:03+00:00

This reverts commit 6a8f1d8d701462937ce01a3f2219af5435372af7 which is
commit 0a42e99b58a208839626465af194cfe640ef9493 upstream.

It does not work properly in the 4.9.y tree and causes more problems
than it fixes, so revert it.

Reported-by: Thomas Lindroth 
Reported-by: Jan Kara 
Cc: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

Revert "loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl()"

2019-03-05T16:57:03+00:00

This reverts commit 5d3cf50105d007adc54949e0caeca1e944549723 which is
commit 628bd85947091830a8c4872adfd5ed1d515a9cf2 upstream.

It does not work properly in the 4.9.y tree and causes more problems
than it fixes, so revert it.

Reported-by: Thomas Lindroth 
Reported-by: Jan Kara 
Cc: syzbot 
Cc: Ming Lei 
Cc: Tetsuo Handa 
Cc: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl()

2019-01-23T07:10:57+00:00

commit 628bd85947091830a8c4872adfd5ed1d515a9cf2 upstream.

Commit 0a42e99b58a20883 ("loop: Get rid of loop_index_mutex") forgot to
remove mutex_unlock(&loop_ctl_mutex) from loop_control_ioctl() when
replacing loop_index_mutex with loop_ctl_mutex.

Fixes: 0a42e99b58a20883 ("loop: Get rid of loop_index_mutex")
Reported-by: syzbot 
Reviewed-by: Ming Lei 
Reviewed-by: Jan Kara 
Signed-off-by: Tetsuo Handa 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

loop: Get rid of loop_index_mutex

2019-01-23T07:10:56+00:00

commit 0a42e99b58a208839626465af194cfe640ef9493 upstream.

Now that loop_ctl_mutex is global, just get rid of loop_index_mutex as
there is no good reason to keep these two separate and it just
complicates the locking.

Signed-off-by: Jan Kara 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

loop: Fold __loop_release into loop_release

2019-01-23T07:10:56+00:00

commit 967d1dc144b50ad005e5eecdfadfbcfb399ffff6 upstream.

__loop_release() has a single call site. Fold it there. This is
currently not a huge win but it will make following replacement of
loop_index_mutex more obvious.

Signed-off-by: Jan Kara 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman