From patchwork Fri Mar 1 01:30:20 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Genjian X-Patchwork-Id: 13577811 Received: from m16.mail.126.com (m16.mail.126.com [117.135.210.8]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 5EF3D2B9C1; Fri, 1 Mar 2024 01:32:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.8 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256779; cv=none; b=JlH9RtgaeI/A7LJ8xc0XkHWJ+OPRXU1AhoNC6/FWASKTqKTX4cAe39Ofkp0Vbg7FsHgXzilTOWj2hw5YLJ4ZCQgsGkYaH1c1id6VBQa/pbaIGzAPkY/hqc5Zz3MZaZHm7JIMwEv9t/heCtbKcmV0Xews/dg734hq1m5jcKM7tj0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256779; c=relaxed/simple; bh=tuGC5wyFcsYrlqp5HtH5FDj3u0VQ99pcTwEH86G7J5E=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version:Content-Type; b=ulW+wTAiRcKCSAvOUV7u47CETETWtT/wpL+aqB/HlrA3Oq8UZ4Gge5h2frPgbD5BKPKjEojHZy0lAmFiF71Y+D3/Z05xgDK1577ZrEyREDfXyLDm97f0OsxCfW1TOCYQ7xSYv1oiqPWggg2EJ/3Cc97Ukfg57lcWYLMymnWLdTA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=F0L2SzkO; arc=none smtp.client-ip=117.135.210.8 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="F0L2SzkO" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version: Content-Type; bh=yUP3Fg8UEbX0/ycHA5FJkvcoXBqMXasQLvzZECI1t5M=; b=F0L2SzkOb3RAVKgrBWl58jW4HIf8CoFr2ofNFMAogRGxSJut4OmQXfbjWxFBWt A9Z6aRA1RUVah3RZFeWPoxEpjolGM/hsfI7ftNwa1XgEGQwH0GyEVXdhbgTgQhNo eSTu4uMVAqOfSu0O/7ArOfYMkmT//QNCJCe11Dtl2Eq7c= Received: from localhost.localdomain (unknown [116.128.244.171]) by gzga-smtp-mta-g1-0 (Coremail) with SMTP id _____wDn7+APMOFlZSfbBA--.18054S5; Fri, 01 Mar 2024 09:32:37 +0800 (CST) From: Genjian To: stable@vger.kernel.org Cc: axboe@kernel.dk, stable@kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, zhanggenjian123@gmail.com, Genjian Zhang , k2ci Subject: [PATCH 4.19.y 1/9] Revert "loop: Check for overflow while configuring loop" Date: Fri, 1 Mar 2024 09:30:20 +0800 Message-Id: <20240301013028.2293831-2-zhanggenjian@126.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240301013028.2293831-1-zhanggenjian@126.com> References: <20240301013028.2293831-1-zhanggenjian@126.com> Precedence: bulk X-Mailing-List: linux-block@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-CM-TRANSID: _____wDn7+APMOFlZSfbBA--.18054S5 X-Coremail-Antispam: 1Uf129KBjvJXoW3Jw1UGw45uw4rGr47tF43KFg_yoW3XrW5pF 1S9FWxCw48KrykWw4UCr48tr17Aa1DC3WjyFZakw13ZF17Ww1aqa4UJrW0gr9xCryUAFy2 yFn5Jr4rtr1DJw7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07U_l1PUUUUU= X-CM-SenderInfo: x2kd0wxjhqyxldq6ij2wof0z/1tbiyBWUfmWWf0mb9AAAsd From: Genjian Zhang This reverts commit 2035c770bfdbcc82bd52e05871a7c82db9529e0f. This patch lost a unlock loop_ctl_mutex in loop_get_status(...), which caused syzbot to report a UAF issue.The upstream patch does not have this issue. Therefore, we revert this patch and directly apply the upstream patch later on. Risk use-after-free as reported by syzbot： [ 174.437352] BUG: KASAN: use-after-free in __mutex_lock.isra.10+0xbc4/0xc30 [ 174.437772] Read of size 4 at addr ffff8880bac49ab8 by task syz-executor.0/13897 [ 174.438205] [ 174.438306] CPU: 1 PID: 13897 Comm: syz-executor.0 Not tainted 4.19.306 #1 [ 174.438712] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1kylin1 04/01/2014 [ 174.439236] Call Trace: [ 174.439392] dump_stack+0x94/0xc7 [ 174.439596] ? __mutex_lock.isra.10+0xbc4/0xc30 [ 174.439881] print_address_description+0x60/0x229 [ 174.440165] ? __mutex_lock.isra.10+0xbc4/0xc30 [ 174.440436] kasan_report.cold.6+0x241/0x2fd [ 174.440696] __mutex_lock.isra.10+0xbc4/0xc30 [ 174.440959] ? entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 174.441272] ? mutex_trylock+0xa0/0xa0 [ 174.441500] ? entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 174.441816] ? kobject_get_unless_zero+0x129/0x1c0 [ 174.442106] ? kset_unregister+0x30/0x30 [ 174.442351] ? find_symbol_in_section+0x310/0x310 [ 174.442634] ? __mutex_lock_slowpath+0x10/0x10 [ 174.442901] mutex_lock_killable+0xb0/0xf0 [ 174.443149] ? __mutex_lock_killable_slowpath+0x10/0x10 [ 174.443465] ? __mutex_lock_slowpath+0x10/0x10 [ 174.443732] ? _cond_resched+0x10/0x20 [ 174.443966] ? kobject_get+0x54/0xa0 [ 174.444190] lo_open+0x16/0xc0 [ 174.444382] __blkdev_get+0x273/0x10f0 [ 174.444612] ? lo_fallocate.isra.20+0x150/0x150 [ 174.444886] ? bdev_disk_changed+0x190/0x190 [ 174.445146] ? path_init+0x1030/0x1030 [ 174.445371] ? do_syscall_64+0x9a/0x2d0 [ 174.445608] ? deref_stack_reg+0xab/0xe0 [ 174.445852] blkdev_get+0x97/0x880 [ 174.446061] ? walk_component+0x297/0xdc0 [ 174.446303] ? __blkdev_get+0x10f0/0x10f0 [ 174.446547] ? __fsnotify_inode_delete+0x20/0x20 [ 174.446822] blkdev_open+0x1bd/0x240 [ 174.447040] do_dentry_open+0x448/0xf80 [ 174.447274] ? blkdev_get_by_dev+0x60/0x60 [ 174.447522] ? __x64_sys_fchdir+0x1a0/0x1a0 [ 174.447775] ? inode_permission+0x86/0x320 [ 174.448022] path_openat+0xa83/0x3ed0 [ 174.448248] ? path_mountpoint+0xb50/0xb50 [ 174.448495] ? kasan_kmalloc+0xbf/0xe0 [ 174.448723] ? kmem_cache_alloc+0xbc/0x1b0 [ 174.448971] ? getname_flags+0xc4/0x560 [ 174.449203] ? do_sys_open+0x1ce/0x3f0 [ 174.449432] ? do_syscall_64+0x9a/0x2d0 [ 174.449706] ? entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 174.450022] ? __d_alloc+0x2a/0xa50 [ 174.450232] ? kasan_unpoison_shadow+0x30/0x40 [ 174.450510] ? should_fail+0x117/0x6c0 [ 174.450737] ? timespec64_trunc+0xc1/0x150 [ 174.450986] ? inode_init_owner+0x2e0/0x2e0 [ 174.451237] ? timespec64_trunc+0xc1/0x150 [ 174.451484] ? inode_init_owner+0x2e0/0x2e0 [ 174.451736] do_filp_open+0x197/0x270 [ 174.451959] ? may_open_dev+0xd0/0xd0 [ 174.452182] ? kasan_unpoison_shadow+0x30/0x40 [ 174.452448] ? kasan_kmalloc+0xbf/0xe0 [ 174.452672] ? __alloc_fd+0x1a3/0x4b0 [ 174.452895] do_sys_open+0x2c7/0x3f0 [ 174.453114] ? filp_open+0x60/0x60 [ 174.453320] do_syscall_64+0x9a/0x2d0 [ 174.453541] ? prepare_exit_to_usermode+0xf3/0x170 [ 174.453832] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 174.454136] RIP: 0033:0x41edee [ 174.454321] Code: 25 00 00 41 00 3d 00 00 41 00 74 48 48 c7 c0 a4 af 0b 01 8b 00 85 c0 75 69 89 f2 b8 01 01 00 00 48 89 fe bf 9c ff ff ff 0f 05 <48> 3d 00 f0 ff ff 0f 87 a6 00 00 00 48 8b 4c 24 28 64 48 33 0c5 [ 174.455404] RSP: 002b:00007ffd2501fbd0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 174.455854] RAX: ffffffffffffffda RBX: 00007ffd2501fc90 RCX: 000000000041edee [ 174.456273] RDX: 0000000000000002 RSI: 00007ffd2501fcd0 RDI: 00000000ffffff9c [ 174.456698] RBP: 0000000000000003 R08: 0000000000000001 R09: 00007ffd2501f9a7 [ 174.457116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 174.457535] R13: 0000000000565e48 R14: 00007ffd2501fcd0 R15: 0000000000400510 [ 174.457955] [ 174.458052] Allocated by task 945: [ 174.458261] kasan_kmalloc+0xbf/0xe0 [ 174.458478] kmem_cache_alloc_node+0xb4/0x1d0 [ 174.458743] copy_process.part.57+0x14b0/0x7010 [ 174.459017] _do_fork+0x197/0x980 [ 174.459218] kernel_thread+0x2f/0x40 [ 174.459438] call_usermodehelper_exec_work+0xa8/0x240 [ 174.459742] process_one_work+0x933/0x13b0 [ 174.459986] worker_thread+0x8c/0x1000 [ 174.460212] kthread+0x343/0x410 [ 174.460408] ret_from_fork+0x35/0x40 [ 174.460621] [ 174.460716] Freed by task 22902: [ 174.460913] __kasan_slab_free+0x125/0x170 [ 174.461159] kmem_cache_free+0x6e/0x1b0 [ 174.461391] __put_task_struct+0x1c4/0x440 [ 174.461636] delayed_put_task_struct+0x135/0x170 [ 174.461915] rcu_process_callbacks+0x578/0x15c0 [ 174.462184] __do_softirq+0x175/0x60e [ 174.462403] [ 174.462501] The buggy address belongs to the object at ffff8880bac49a80 [ 174.462501] which belongs to the cache task_struct of size 3264 [ 174.463235] The buggy address is located 56 bytes inside of [ 174.463235] 3264-byte region [ffff8880bac49a80, ffff8880bac4a740) [ 174.463923] The buggy address belongs to the page: [ 174.464210] page:ffffea0002eb1200 count:1 mapcount:0 mapping:ffff888188ca0a00 index:0x0 compound_mapcount: 0 [ 174.464784] flags: 0x100000000008100(slab|head) [ 174.465079] raw: 0100000000008100 ffffea0002eaa400 0000000400000004 ffff888188ca0a00 [ 174.465533] raw: 0000000000000000 0000000000090009 00000001ffffffff 0000000000000000 [ 174.465988] page dumped because: kasan: bad access detected [ 174.466321] [ 174.466322] Memory state around the buggy address: [ 174.466325] ffff8880bac49980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 174.466327] ffff8880bac49a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 174.466329] >ffff8880bac49a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 174.466329] ^ [ 174.466331] ffff8880bac49b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 174.466333] ffff8880bac49b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 174.466333] ================================================================== [ 174.466338] Disabling lock debugging due to kernel taint Reported-by: k2ci Signed-off-by: Genjian Zhang --- drivers/block/loop.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 2e6c3f658894..52481f1f8d01 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1351,11 +1351,6 @@ loop_get_status(struct loop_device *lo, struct loop_info64 *info) info->lo_number = lo->lo_number; info->lo_offset = lo->lo_offset; info->lo_sizelimit = lo->lo_sizelimit; - - /* loff_t vars have been assigned __u64 */ - if (lo->lo_offset < 0 || lo->lo_sizelimit < 0) - return -EOVERFLOW; - info->lo_flags = lo->lo_flags; memcpy(info->lo_file_name, lo->lo_file_name, LO_NAME_SIZE); memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE); From patchwork Fri Mar 1 01:30:21 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Genjian X-Patchwork-Id: 13577816 Received: from m16.mail.126.com (m16.mail.126.com [220.197.31.6]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 69AD12E416; Fri, 1 Mar 2024 01:33:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=220.197.31.6 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256794; cv=none; b=AivCyWmVrDaToGGQy9lTGrgheLzcUUB8OBf3puoFRfc1T7Twu5XgD8CnJ8x03fk++PezdNelbefuTzePAPuYgZEEJ5th2kMsBzMcmuLGJhLCmd8kwgywK+mH1NEvhtxKAwOA9HcxwVOE/ycczcfk2DcCSKV9uPltGe8Su5Mfbsg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256794; c=relaxed/simple; bh=lbTVUMhxn1ktqI2lN9lgHcss1yek4QTPVEjRudHaEF4=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=guDCQw/3B6/T2e05xr+RM7Itqto70EMcBbKYRAdREfVK0ucW+a77rCjxp5gTnn29CJWPfbDBIhsTezOaqwbnOtPmlDCv/E9h/vcK53Hga8QPJAixBzE1Q7wA+gV2I/XLzo+aagkPJ2RUiuLdhRfQtp0ommNgwCQCqRNrNCpEjk8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=H/ka5F9V; arc=none smtp.client-ip=220.197.31.6 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="H/ka5F9V" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=8CY1O Dlw6c1e5TwxkQwAen6QJmz56H/WmfOZ5M5TNM0=; b=H/ka5F9VbgyctHVrx1qn9 bu1MR3Ms18eCq9AjYs+dTnFsm6NzfYDlNWN9mHmreS9iZzqGBayqh8TLNneTZLFQ ozUb30wpFAmlOA+t5yKgkPyOfj4f9YjCuK2u+b8l3r87DOBNZIQYD0XzM2Hx2TDQ NxOnxF/aaBXn/Rbnn3YQss= Received: from localhost.localdomain (unknown [116.128.244.171]) by gzga-smtp-mta-g1-0 (Coremail) with SMTP id _____wDn7+APMOFlZSfbBA--.18054S6; Fri, 01 Mar 2024 09:32:38 +0800 (CST) From: Genjian To: stable@vger.kernel.org Cc: axboe@kernel.dk, stable@kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, zhanggenjian123@gmail.com, Martijn Coenen , Christoph Hellwig , Bob Liu , Bart Van Assche , Genjian Zhang Subject: [PATCH 4.19.y 2/9] loop: Call loop_config_discard() only after new config is applied Date: Fri, 1 Mar 2024 09:30:21 +0800 Message-Id: <20240301013028.2293831-3-zhanggenjian@126.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240301013028.2293831-1-zhanggenjian@126.com> References: <20240301013028.2293831-1-zhanggenjian@126.com> Precedence: bulk X-Mailing-List: linux-block@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-CM-TRANSID: _____wDn7+APMOFlZSfbBA--.18054S6 X-Coremail-Antispam: 1Uf129KBjvJXoW7Ar43AryfuFy7try5Xr4xZwb_yoW8WrWxpF nrWFyjyFWvgF48CFWUWrWkZa45Gan7G3y3XFW2k3y5ur43Z3savr9Ika4xXr1DJFW8WFWY v3Zakr10qw1UCrDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07UiqXLUUUUU= X-CM-SenderInfo: x2kd0wxjhqyxldq6ij2wof0z/1tbiyBqUfmWWf0mcQwAAsi From: Martijn Coenen [ Upstream commit 7c5014b0987a30e4989c90633c198aced454c0ec ] loop_set_status() calls loop_config_discard() to configure discard for the loop device; however, the discard configuration depends on whether the loop device uses encryption, and when we call it the encryption configuration has not been updated yet. Move the call down so we apply the correct discard configuration based on the new configuration. Signed-off-by: Martijn Coenen Reviewed-by: Christoph Hellwig Reviewed-by: Bob Liu Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe Signed-off-by: Genjian Zhang --- drivers/block/loop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 52481f1f8d01..bd94406b90c9 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1286,8 +1286,6 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) } } - loop_config_discard(lo); - memcpy(lo->lo_file_name, info->lo_file_name, LO_NAME_SIZE); memcpy(lo->lo_crypt_name, info->lo_crypt_name, LO_NAME_SIZE); lo->lo_file_name[LO_NAME_SIZE-1] = 0; @@ -1311,6 +1309,8 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) lo->lo_key_owner = uid; } + loop_config_discard(lo); + /* update dio if lo_offset or transfer is changed */ __loop_update_dio(lo, lo->use_dio); From patchwork Fri Mar 1 01:30:22 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Genjian X-Patchwork-Id: 13577815 Received: from m16.mail.126.com (m16.mail.126.com [117.135.210.7]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 2A24138DC3; Fri, 1 Mar 2024 01:33:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.7 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256792; cv=none; b=RS/XotqBPd/IO3nAo/iIjQIIeGsxyXyprUKhO2gaZ0NQk9qX7rXu0+uutXpyTTg2OMyAv6Wn4UEJHwvIbTg/oGfPU1wIp7dfH3Jpkp0qY4XVD0SGgSg4WhqvpQ28eA8K0wgpNt+Unqk7sl5mJtbL9aZJBeIYBSgbVrcz8T1M7co= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256792; c=relaxed/simple; bh=//shxWOgs6DUM19ppmRaIyOvk+IKSFn/j4eaP7r+Vgs=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=I7yze/Wte9hvaRdra7+xwFaJZWgwvB3JKD6vffdiaoHCWDqX2B2Q4nIHGLFKnhG1kleRfOgyrC80t2cDjlub3VG0d0iUnlNGu2cwmnZ5nYcjSnyVSxh3liNr6DHeengLV0DN44ohG5mJbVAPJyyXa29TvOYIXvKujv1BZSWF3d0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=LNV7gEd4; arc=none smtp.client-ip=117.135.210.7 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="LNV7gEd4" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=EqfKZ GDvpnWQ+qwyxpLC5/VVhwI3t8YX1f9H+0jPymU=; b=LNV7gEd4lcR0AT8fPpbOh isQfXcqySwZELJK+RkJV1ziIir+AwX7UsmPT28xH64Dqo+1lDj8mwKGttJWpjLJr 1jDiTpXu4BrfwP57HCsD37lZ+ckRHy+eRIUmMm8X/DAzbUYbJS9ywMq31/t4A9dc 1JK62+ID1kKXLEx0a9Gmzg= Received: from localhost.localdomain (unknown [116.128.244.171]) by gzga-smtp-mta-g1-0 (Coremail) with SMTP id _____wDn7+APMOFlZSfbBA--.18054S7; Fri, 01 Mar 2024 09:32:39 +0800 (CST) From: Genjian To: stable@vger.kernel.org Cc: axboe@kernel.dk, stable@kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, zhanggenjian123@gmail.com, Martijn Coenen , Christoph Hellwig , Genjian Zhang Subject: [PATCH 4.19.y 3/9] loop: Remove sector_t truncation checks Date: Fri, 1 Mar 2024 09:30:22 +0800 Message-Id: <20240301013028.2293831-4-zhanggenjian@126.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240301013028.2293831-1-zhanggenjian@126.com> References: <20240301013028.2293831-1-zhanggenjian@126.com> Precedence: bulk X-Mailing-List: linux-block@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-CM-TRANSID: _____wDn7+APMOFlZSfbBA--.18054S7 X-Coremail-Antispam: 1Uf129KBjvJXoWxAryDKF45WF17Ar4fuFy3Arb_yoW5Gw4xpF sruFy5AayFqFWxWFsFqr4kZFyYg3ZrW343ury7C3409r1YqrnYqFy3AryFgrWktrykZF1Y vws8JFy8ur1UCr7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07jUYFZUUUUU= X-CM-SenderInfo: x2kd0wxjhqyxldq6ij2wof0z/1tbiHhmUfmV2z7wVDwABsW From: Martijn Coenen [ Upstream commit 083a6a50783ef54256eec3499e6575237e0e3d53 ] sector_t is now always u64, so we don't need to check for truncation. Signed-off-by: Martijn Coenen Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe Signed-off-by: Genjian Zhang --- drivers/block/loop.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index bd94406b90c9..281aefba2a6f 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -225,24 +225,20 @@ static void __loop_update_dio(struct loop_device *lo, bool dio) blk_mq_unfreeze_queue(lo->lo_queue); } -static int +static void figure_loop_size(struct loop_device *lo, loff_t offset, loff_t sizelimit) { loff_t size = get_size(offset, sizelimit, lo->lo_backing_file); - sector_t x = (sector_t)size; struct block_device *bdev = lo->lo_device; - if (unlikely((loff_t)x != size)) - return -EFBIG; if (lo->lo_offset != offset) lo->lo_offset = offset; if (lo->lo_sizelimit != sizelimit) lo->lo_sizelimit = sizelimit; - set_capacity(lo->lo_disk, x); + set_capacity(lo->lo_disk, size); bd_set_size(bdev, (loff_t)get_capacity(bdev->bd_disk) << 9); /* let user-space know about the new size */ kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE); - return 0; } static inline int @@ -972,10 +968,8 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode, !file->f_op->write_iter) lo_flags |= LO_FLAGS_READ_ONLY; - error = -EFBIG; size = get_loop_size(lo, file); - if ((loff_t)(sector_t)size != size) - goto out_unlock; + error = loop_prepare_queue(lo); if (error) goto out_unlock; @@ -1280,10 +1274,7 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) lo->lo_device->bd_inode->i_mapping->nrpages); goto out_unfreeze; } - if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit)) { - err = -EFBIG; - goto out_unfreeze; - } + figure_loop_size(lo, info->lo_offset, info->lo_sizelimit); } memcpy(lo->lo_file_name, info->lo_file_name, LO_NAME_SIZE); @@ -1486,7 +1477,9 @@ static int loop_set_capacity(struct loop_device *lo) if (unlikely(lo->lo_state != Lo_bound)) return -ENXIO; - return figure_loop_size(lo, lo->lo_offset, lo->lo_sizelimit); + figure_loop_size(lo, lo->lo_offset, lo->lo_sizelimit); + + return 0; } static int loop_set_dio(struct loop_device *lo, unsigned long arg) From patchwork Fri Mar 1 01:30:23 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Genjian X-Patchwork-Id: 13577813 Received: from m16.mail.126.com (m16.mail.126.com [117.135.210.7]) by smtp.subspace.kernel.org (Postfix) with ESMTP id D953F3984A; Fri, 1 Mar 2024 01:33:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.7 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256787; cv=none; b=S56VLnaNeIiu1oijXwKSZX+NmR8AUOaR+2+Fbmzm6qbDh6DjiKCVtc48neIf2z0BLKu68SMT+0cC7+pTpbXKaWne4lML+/HN9dBDMOAtrJmMkNuPeFNv61/hdXnGN7Yrc3DbCZxtw1k3TkixekhqOkRyhXc45h9OG9qrwFgg8X8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256787; c=relaxed/simple; bh=xLeQQdqrm7Aq4hmh/vp/0FElKtBEhB5LlHFCYph3wdY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=QffO0zFnirgv0MbLvd4TJlshtlCBQP09O9uqi0GSQEjlEadtD8Xcy7DmJfGhFsIDYyqpBZTSTclXjKhcp4ef6i1jyLZoCgcAuVOuNRpfvYUi5iRMsRf3t9RL3x1aaZb9+LMMNwsSefJuU6AU5gy/8hK8NhXZxgU+WrR8HPG5uMw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=KXTKZuBI; arc=none smtp.client-ip=117.135.210.7 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="KXTKZuBI" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=dcrWG GH+E6Je/BEs6GtPRlXPUQyROv4t+ihp6LPlmU4=; b=KXTKZuBIgKG9unmmvJeI1 2wCEszZcamQ5OQgZxrcqQ+ON+CXdSAp2dk+2gE3lDflVo7z3+dbE+IO9IRKJ3RMj rxITFLhc3yl1Lp2fO9kYPEv5rN4R2/eTgq6ApHRv57VQbGEUf4znVnRtWFH/5xNk 8si+uE+ZXvMMbybPqS2eOI= Received: from localhost.localdomain (unknown [116.128.244.171]) by gzga-smtp-mta-g1-0 (Coremail) with SMTP id _____wDn7+APMOFlZSfbBA--.18054S8; Fri, 01 Mar 2024 09:32:39 +0800 (CST) From: Genjian To: stable@vger.kernel.org Cc: axboe@kernel.dk, stable@kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, zhanggenjian123@gmail.com, Martijn Coenen , Christoph Hellwig , Genjian Zhang Subject: [PATCH 4.19.y 4/9] loop: Factor out setting loop device size Date: Fri, 1 Mar 2024 09:30:23 +0800 Message-Id: <20240301013028.2293831-5-zhanggenjian@126.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240301013028.2293831-1-zhanggenjian@126.com> References: <20240301013028.2293831-1-zhanggenjian@126.com> Precedence: bulk X-Mailing-List: linux-block@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-CM-TRANSID: _____wDn7+APMOFlZSfbBA--.18054S8 X-Coremail-Antispam: 1Uf129KBjvJXoWxZF47GrW5Xw1kZFWfWr4kZwb_yoW5Jw17pF 13Wa43G3yFvFy7WFsIqr1kZrW5Ka1kW347ury3C34Y9a1YyrnagF4rAry8WrWkJrWkWF1Y qa98Ar109r1UGw7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07UHCJQUUUUU= X-CM-SenderInfo: x2kd0wxjhqyxldq6ij2wof0z/1tbiHhmUfmV2z7wVDwAAsX From: Martijn Coenen [ Upstream commit 5795b6f5607f7e4db62ddea144727780cb351a9b ] This code is used repeatedly. Signed-off-by: Martijn Coenen Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe Signed-off-by: Genjian Zhang --- drivers/block/loop.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 281aefba2a6f..6bd07fa3a1fc 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -225,20 +225,35 @@ static void __loop_update_dio(struct loop_device *lo, bool dio) blk_mq_unfreeze_queue(lo->lo_queue); } +/** + * loop_set_size() - sets device size and notifies userspace + * @lo: struct loop_device to set the size for + * @size: new size of the loop device + * + * Callers must validate that the size passed into this function fits into + * a sector_t, eg using loop_validate_size() + */ +static void loop_set_size(struct loop_device *lo, loff_t size) +{ + struct block_device *bdev = lo->lo_device; + + set_capacity(lo->lo_disk, size); + bd_set_size(bdev, size << SECTOR_SHIFT); + /* let user-space know about the new size */ + kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE); +} + static void figure_loop_size(struct loop_device *lo, loff_t offset, loff_t sizelimit) { loff_t size = get_size(offset, sizelimit, lo->lo_backing_file); - struct block_device *bdev = lo->lo_device; if (lo->lo_offset != offset) lo->lo_offset = offset; if (lo->lo_sizelimit != sizelimit) lo->lo_sizelimit = sizelimit; - set_capacity(lo->lo_disk, size); - bd_set_size(bdev, (loff_t)get_capacity(bdev->bd_disk) << 9); - /* let user-space know about the new size */ - kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE); + + loop_set_size(lo, size); } static inline int @@ -992,11 +1007,8 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode, blk_queue_write_cache(lo->lo_queue, true, false); loop_update_dio(lo); - set_capacity(lo->lo_disk, size); - bd_set_size(bdev, size << 9); loop_sysfs_init(lo); - /* let user-space know about the new size */ - kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE); + loop_set_size(lo, size); set_blocksize(bdev, S_ISBLK(inode->i_mode) ? block_size(inode->i_bdev) : PAGE_SIZE); From patchwork Fri Mar 1 01:30:24 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Genjian X-Patchwork-Id: 13577814 Received: from m16.mail.126.com (m16.mail.126.com [117.135.210.8]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 271CB38F84; Fri, 1 Mar 2024 01:33:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.8 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256789; cv=none; b=FtwhFgzOa0ZOEzKtN9dh5JRZN4sZQERC0engnlKpP2M5KUrq9ak0dEQHlNX9arlAAY+n4HYPorHjPeyxaJMfTQW9HW1c8EtewcVJB8RYbOkPgGmRW3c/aCcZU+eDoo3EVtJyWHWsysWianKs3sw/FwLBcpOKPn3JhpCqvR+7z2s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256789; c=relaxed/simple; bh=JjZ7W3t4/yI9ATJXoIRSdNMeNL4PQtI7LA+8bo2tGz0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=JIW5YympEiy4WxVbh88V3XjjWM97kYPEUKsNxswFBoaRVolMUfxLrRvEtbs2T4ZGoDcnsS6T5It8wAXHlGj+k/Ia4JMmJVEoHd/1ZauNx1AAhSotHwyq7WyUAZxc105Uq0gabaE1gilDDFscRQto/lLJjbzW6wiAY9o4+Y01kVg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=YrvIPpMC; arc=none smtp.client-ip=117.135.210.8 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="YrvIPpMC" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=k22cU pbPjJDJz3jqCUUmugzbccutXgTxXfhtlbr5D/8=; b=YrvIPpMC8oi+gEuig4XaK /qIVNyKK/o+OkA43Cg9FWq6xJ5QbdgPGsRLLPjrOF2EyDEFGndXpB5BGk4cU8myQ PaCDddbU201LAll9nzWsN3W45wOTNmQgV9t1PjEGksTBySt3JT/T8mhH1k6lmahJ 5AjEaN22uR0FpsJUQjWmkM= Received: from localhost.localdomain (unknown [116.128.244.171]) by gzga-smtp-mta-g1-0 (Coremail) with SMTP id _____wDn7+APMOFlZSfbBA--.18054S9; Fri, 01 Mar 2024 09:32:40 +0800 (CST) From: Genjian To: stable@vger.kernel.org Cc: axboe@kernel.dk, stable@kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, zhanggenjian123@gmail.com, Martijn Coenen , Christoph Hellwig , Genjian Zhang Subject: [PATCH 4.19.y 5/9] loop: Refactor loop_set_status() size calculation Date: Fri, 1 Mar 2024 09:30:24 +0800 Message-Id: <20240301013028.2293831-6-zhanggenjian@126.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240301013028.2293831-1-zhanggenjian@126.com> References: <20240301013028.2293831-1-zhanggenjian@126.com> Precedence: bulk X-Mailing-List: linux-block@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-CM-TRANSID: _____wDn7+APMOFlZSfbBA--.18054S9 X-Coremail-Antispam: 1Uf129KBjvJXoWxCr1rWw13XryDAr43GrWUCFg_yoWrXw1kpF nFga4Yy3yFqFW8WFsFqr4kuFW5G3WDC3y3Ary7J34jyr1jqr9aqrW2kryrW397Jr95ZayY qan8tr1kuw1Uur7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07UdUUbUUUUU= X-CM-SenderInfo: x2kd0wxjhqyxldq6ij2wof0z/1tbiyBqUfmWWf0mcQwABsj From: Martijn Coenen [ Upstream commit b0bd158dd630bd47640e0e418c062cda1e0da5ad ] figure_loop_size() calculates the loop size based on the passed in parameters, but at the same time it updates the offset and sizelimit parameters in the loop device configuration. That is a somewhat unexpected side effect of a function with this name, and it is only only needed by one of the two callers of this function - loop_set_status(). Move the lo_offset and lo_sizelimit assignment back into loop_set_status(), and use the newly factored out functions to validate and apply the newly calculated size. This allows us to get rid of figure_loop_size() in a follow-up commit. Signed-off-by: Martijn Coenen Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe Signed-off-by: Genjian Zhang --- drivers/block/loop.c | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 6bd07fa3a1fc..1a6805642ed2 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -248,11 +248,6 @@ figure_loop_size(struct loop_device *lo, loff_t offset, loff_t sizelimit) { loff_t size = get_size(offset, sizelimit, lo->lo_backing_file); - if (lo->lo_offset != offset) - lo->lo_offset = offset; - if (lo->lo_sizelimit != sizelimit) - lo->lo_sizelimit = sizelimit; - loop_set_size(lo, size); } @@ -1225,6 +1220,7 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) kuid_t uid = current_uid(); struct block_device *bdev; bool partscan = false; + bool size_changed = false; err = mutex_lock_killable(&loop_ctl_mutex); if (err) @@ -1246,6 +1242,7 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) if (lo->lo_offset != info->lo_offset || lo->lo_sizelimit != info->lo_sizelimit) { + size_changed = true; sync_blockdev(lo->lo_device); invalidate_bdev(lo->lo_device); } @@ -1253,6 +1250,15 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) /* I/O need to be drained during transfer transition */ blk_mq_freeze_queue(lo->lo_queue); + if (size_changed && lo->lo_device->bd_inode->i_mapping->nrpages) { + /* If any pages were dirtied after invalidate_bdev(), try again */ + err = -EAGAIN; + pr_warn("%s: loop%d (%s) has still dirty pages (nrpages=%lu)\n", + __func__, lo->lo_number, lo->lo_file_name, + lo->lo_device->bd_inode->i_mapping->nrpages); + goto out_unfreeze; + } + err = loop_release_xfer(lo); if (err) goto out_unfreeze; @@ -1276,19 +1282,8 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) if (err) goto out_unfreeze; - if (lo->lo_offset != info->lo_offset || - lo->lo_sizelimit != info->lo_sizelimit) { - /* kill_bdev should have truncated all the pages */ - if (lo->lo_device->bd_inode->i_mapping->nrpages) { - err = -EAGAIN; - pr_warn("%s: loop%d (%s) has still dirty pages (nrpages=%lu)\n", - __func__, lo->lo_number, lo->lo_file_name, - lo->lo_device->bd_inode->i_mapping->nrpages); - goto out_unfreeze; - } - figure_loop_size(lo, info->lo_offset, info->lo_sizelimit); - } - + lo->lo_offset = info->lo_offset; + lo->lo_sizelimit = info->lo_sizelimit; memcpy(lo->lo_file_name, info->lo_file_name, LO_NAME_SIZE); memcpy(lo->lo_crypt_name, info->lo_crypt_name, LO_NAME_SIZE); lo->lo_file_name[LO_NAME_SIZE-1] = 0; @@ -1312,6 +1307,12 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) lo->lo_key_owner = uid; } + if (size_changed) { + loff_t new_size = get_size(lo->lo_offset, lo->lo_sizelimit, + lo->lo_backing_file); + loop_set_size(lo, new_size); + } + loop_config_discard(lo); /* update dio if lo_offset or transfer is changed */ From patchwork Fri Mar 1 01:30:25 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Genjian X-Patchwork-Id: 13577812 Received: from m16.mail.126.com (m16.mail.126.com [220.197.31.7]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 58D7A2B9D2; Fri, 1 Mar 2024 01:32:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=220.197.31.7 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256781; cv=none; b=vAF1h151rCPm6DNSEwyvjZa9AF9LbsOMN2wbPXuiO24Ew/hapaLKHNXfdQGx3sOAdCsaQar4wJqNzdt9zdOLdYTp8a2hvAMidKIu91qpo3WPu5ZbiWvt7TcqKNedvZDyLSsWwTv3ytNOq6mIDiIft4GRM+8HZ/lsfHGhfoexR2k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256781; c=relaxed/simple; bh=QWpCBUxGIwvUgnTYWNJI8geGzf6bM31MwNgicX8H3Zc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version:Content-Type; b=CFajZJ6+4Vpza2xUXRgOCno+eSBaKpGJtbJKBeCFSg3mYdIE2gl8w3NL5qOTYRLBpVvZURI4zWo22bCiqqYU8DnFsyh/L19amaa3D/Du7TZxevfp4lH345ufINhAou1WytQd0FgVkM5L6lYI7/sinsVZFWxi0dyzsgimESrFmLU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=CnUngRMp; arc=none smtp.client-ip=220.197.31.7 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="CnUngRMp" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version: Content-Type; bh=ybwauVZPrNHMvNzZYCxzA4shFMPOKAQSqwZ1heSYrjU=; b=CnUngRMpGh+j3GepSLK+vF3aysVSq5oYs+HgeSufvpOIV7gIxxANFX97/HvIHd MU9/56k8CxDoczsl5z6x1vTh96jgk/4lSNCJMRRq7nv7dl2dp8O7TjtfWWbIzJfH 6PchkI/z8agj6V4LZJxAVhFYlZNFJpFhHwUAbZHBJwn+Y= Received: from localhost.localdomain (unknown [116.128.244.171]) by gzga-smtp-mta-g1-0 (Coremail) with SMTP id _____wDn7+APMOFlZSfbBA--.18054S10; Fri, 01 Mar 2024 09:32:41 +0800 (CST) From: Genjian To: stable@vger.kernel.org Cc: axboe@kernel.dk, stable@kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, zhanggenjian123@gmail.com, =?utf-8?q?Holger_H?= =?utf-8?q?offst=C3=A4tte?= , holger@applied-asynchrony.com, Gwendal Grignou , Benjamin Gordon , Guenter Roeck , Genjian Zhang Subject: [PATCH 4.19.y 6/9] loop: properly observe rotational flag of underlying device Date: Fri, 1 Mar 2024 09:30:25 +0800 Message-Id: <20240301013028.2293831-7-zhanggenjian@126.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240301013028.2293831-1-zhanggenjian@126.com> References: <20240301013028.2293831-1-zhanggenjian@126.com> Precedence: bulk X-Mailing-List: linux-block@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-CM-TRANSID: _____wDn7+APMOFlZSfbBA--.18054S10 X-Coremail-Antispam: 1Uf129KBjvJXoWxCryUKFy8Xr4UWr4rZr4fKrg_yoW5XryDpF W3JFy0kay8KFWxWF4Iqa17ZFyak3Wvk343W3srCwn09w13Jr9aqa4fJFyUXFW8trZ5GF4Y qFWYgFyvkr4UCF7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07UHCJQUUUUU= X-CM-SenderInfo: x2kd0wxjhqyxldq6ij2wof0z/1tbiHhmUfmV2z7wVDwACsV From: Holger Hoffstätte [ Upstream commit 56a85fd8376ef32458efb6ea97a820754e12f6bb ] The loop driver always declares the rotational flag of its device as rotational, even when the device of the mapped file is nonrotational, as is the case with SSDs or on tmpfs. This can confuse filesystem tools which are SSD-aware; in my case I frequently forget to tell mkfs.btrfs that my loop device on tmpfs is nonrotational, and that I really don't need any automatic metadata redundancy. The attached patch fixes this by introspecting the rotational flag of the mapped file's underlying block device, if it exists. If the mapped file's filesystem has no associated block device - as is the case on e.g. tmpfs - we assume nonrotational storage. If there is a better way to identify such non-devices I'd love to hear them. Cc: Jens Axboe Cc: linux-block@vger.kernel.org Cc: holger@applied-asynchrony.com Signed-off-by: Holger Hoffstätte Signed-off-by: Gwendal Grignou Signed-off-by: Benjamin Gordon Reviewed-by: Guenter Roeck Signed-off-by: Jens Axboe Signed-off-by: Genjian Zhang --- drivers/block/loop.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 1a6805642ed2..7a0461a6160b 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -940,6 +940,24 @@ static int loop_prepare_queue(struct loop_device *lo) return 0; } +static void loop_update_rotational(struct loop_device *lo) +{ + struct file *file = lo->lo_backing_file; + struct inode *file_inode = file->f_mapping->host; + struct block_device *file_bdev = file_inode->i_sb->s_bdev; + struct request_queue *q = lo->lo_queue; + bool nonrot = true; + + /* not all filesystems (e.g. tmpfs) have a sb->s_bdev */ + if (file_bdev) + nonrot = blk_queue_nonrot(bdev_get_queue(file_bdev)); + + if (nonrot) + blk_queue_flag_set(QUEUE_FLAG_NONROT, q); + else + blk_queue_flag_clear(QUEUE_FLAG_NONROT, q); +} + static int loop_set_fd(struct loop_device *lo, fmode_t mode, struct block_device *bdev, unsigned int arg) { @@ -1001,6 +1019,7 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode, if (!(lo_flags & LO_FLAGS_READ_ONLY) && file->f_op->fsync) blk_queue_write_cache(lo->lo_queue, true, false); + loop_update_rotational(lo); loop_update_dio(lo); loop_sysfs_init(lo); loop_set_size(lo, size); From patchwork Fri Mar 1 01:30:26 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Genjian X-Patchwork-Id: 13577851 Received: from m16.mail.126.com (m16.mail.126.com [117.135.210.9]) by smtp.subspace.kernel.org (Postfix) with ESMTP id EAD208480; Fri, 1 Mar 2024 01:48:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.9 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709257713; cv=none; b=tJuE4G0L6k16owbFe9XPrE+/hR0+9Vo3dsmNDG9Mo/qSxvEdBAmFH1G4u6UTvL94R6bvLsR5ZZRexFRLuR4h2rSMXm6JpIGwxAR8J4yZVIvpOBupP/jHgKp3mv7NIE2s2sKqWfRxMTLV/rjpMfvyL2RTBdhfqY6H4OiIKt06Ch4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709257713; c=relaxed/simple; bh=HGs2pX7FHJP2Y4FhixbXqLtBnijA94aNSBoCNN9F45c=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=XPUmzp9s7kxfowpJTKiMjgdV9YIfUrFAgwbpTamTOzwtUpolsm4XVRXwkydXGNWUu1soAfYnfIHYW/9HUF7FkWMyrfRl14CLV4L9EOEXrMbE+DbaHBXioqzNeaZjjLLwSa9dEYHEuWK3pknFpZgJ1xgxYnZHCHt2MbulGtuDXJQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=DbS+CW3j; arc=none smtp.client-ip=117.135.210.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="DbS+CW3j" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=UP35/ x1DvcN4UtxHZ4Qd/W3d6f5lVbqfBVaL96eFqTs=; b=DbS+CW3jjkILRBFXBm9Su 9HjDT+OjtJdY6whYjnt4PkoVpcbx1t8RwaoZoJ4brGzjVvrdWFW6jCFyM5zst4CL 8cp5yChYjonwZzYP44uK1Z8IAF76jo703eHUDxmQBUKOIsKzGPrrjNEXHi8NbTdV v+dapzF+puWzZxTvBGOikc= Received: from localhost.localdomain (unknown [116.128.244.171]) by gzga-smtp-mta-g1-0 (Coremail) with SMTP id _____wDn7+APMOFlZSfbBA--.18054S11; Fri, 01 Mar 2024 09:32:42 +0800 (CST) From: Genjian To: stable@vger.kernel.org Cc: axboe@kernel.dk, stable@kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, zhanggenjian123@gmail.com, Martijn Coenen , Christoph Hellwig , Genjian Zhang Subject: [PATCH 4.19.y 7/9] loop: Factor out configuring loop from status Date: Fri, 1 Mar 2024 09:30:26 +0800 Message-Id: <20240301013028.2293831-8-zhanggenjian@126.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240301013028.2293831-1-zhanggenjian@126.com> References: <20240301013028.2293831-1-zhanggenjian@126.com> Precedence: bulk X-Mailing-List: linux-block@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-CM-TRANSID: _____wDn7+APMOFlZSfbBA--.18054S11 X-Coremail-Antispam: 1Uf129KBjvJXoWxCF4xZr43Jw1UJFWDWF43Awb_yoWrtF4rpF sIgFyYyrWFqF1xWF45tw4kWFW5G3Wjk347Cry7J34jkr1jvr9Iq34akryjga97JryDua4Y qa98tF1ruryjkFJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07UHCJQUUUUU= X-CM-SenderInfo: x2kd0wxjhqyxldq6ij2wof0z/1tbiHh6UfmV2z7wVYAAAs- From: Martijn Coenen [ Upstream commit 0c3796c244598122a5d59d56f30d19390096817f ] Factor out this code into a separate function, so it can be reused by other code more easily. Signed-off-by: Martijn Coenen Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe Signed-off-by: Genjian Zhang --- drivers/block/loop.c | 117 +++++++++++++++++++++++++------------------ 1 file changed, 67 insertions(+), 50 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 7a0461a6160b..0fefd21f0c71 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1231,75 +1231,43 @@ static int loop_clr_fd(struct loop_device *lo) return __loop_clr_fd(lo, false); } +/** + * loop_set_status_from_info - configure device from loop_info + * @lo: struct loop_device to configure + * @info: struct loop_info64 to configure the device with + * + * Configures the loop device parameters according to the passed + * in loop_info64 configuration. + */ static int -loop_set_status(struct loop_device *lo, const struct loop_info64 *info) +loop_set_status_from_info(struct loop_device *lo, + const struct loop_info64 *info) { int err; struct loop_func_table *xfer; kuid_t uid = current_uid(); - struct block_device *bdev; - bool partscan = false; - bool size_changed = false; - - err = mutex_lock_killable(&loop_ctl_mutex); - if (err) - return err; - if (lo->lo_encrypt_key_size && - !uid_eq(lo->lo_key_owner, uid) && - !capable(CAP_SYS_ADMIN)) { - err = -EPERM; - goto out_unlock; - } - if (lo->lo_state != Lo_bound) { - err = -ENXIO; - goto out_unlock; - } - if ((unsigned int) info->lo_encrypt_key_size > LO_KEY_SIZE) { - err = -EINVAL; - goto out_unlock; - } - - if (lo->lo_offset != info->lo_offset || - lo->lo_sizelimit != info->lo_sizelimit) { - size_changed = true; - sync_blockdev(lo->lo_device); - invalidate_bdev(lo->lo_device); - } - /* I/O need to be drained during transfer transition */ - blk_mq_freeze_queue(lo->lo_queue); - - if (size_changed && lo->lo_device->bd_inode->i_mapping->nrpages) { - /* If any pages were dirtied after invalidate_bdev(), try again */ - err = -EAGAIN; - pr_warn("%s: loop%d (%s) has still dirty pages (nrpages=%lu)\n", - __func__, lo->lo_number, lo->lo_file_name, - lo->lo_device->bd_inode->i_mapping->nrpages); - goto out_unfreeze; - } + if ((unsigned int) info->lo_encrypt_key_size > LO_KEY_SIZE) + return -EINVAL; err = loop_release_xfer(lo); if (err) - goto out_unfreeze; + return err; if (info->lo_encrypt_type) { unsigned int type = info->lo_encrypt_type; - if (type >= MAX_LO_CRYPT) { - err = -EINVAL; - goto out_unfreeze; - } + if (type >= MAX_LO_CRYPT) + return -EINVAL; xfer = xfer_funcs[type]; - if (xfer == NULL) { - err = -EINVAL; - goto out_unfreeze; - } + if (xfer == NULL) + return -EINVAL; } else xfer = NULL; err = loop_init_xfer(lo, xfer, info); if (err) - goto out_unfreeze; + return err; lo->lo_offset = info->lo_offset; lo->lo_sizelimit = info->lo_sizelimit; @@ -1326,6 +1294,55 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) lo->lo_key_owner = uid; } + return 0; +} + +static int +loop_set_status(struct loop_device *lo, const struct loop_info64 *info) +{ + int err; + struct block_device *bdev; + kuid_t uid = current_uid(); + bool partscan = false; + bool size_changed = false; + + err = mutex_lock_killable(&loop_ctl_mutex); + if (err) + return err; + if (lo->lo_encrypt_key_size && + !uid_eq(lo->lo_key_owner, uid) && + !capable(CAP_SYS_ADMIN)) { + err = -EPERM; + goto out_unlock; + } + if (lo->lo_state != Lo_bound) { + err = -ENXIO; + goto out_unlock; + } + + if (lo->lo_offset != info->lo_offset || + lo->lo_sizelimit != info->lo_sizelimit) { + size_changed = true; + sync_blockdev(lo->lo_device); + invalidate_bdev(lo->lo_device); + } + + /* I/O need to be drained during transfer transition */ + blk_mq_freeze_queue(lo->lo_queue); + + if (size_changed && lo->lo_device->bd_inode->i_mapping->nrpages) { + /* If any pages were dirtied after invalidate_bdev(), try again */ + err = -EAGAIN; + pr_warn("%s: loop%d (%s) has still dirty pages (nrpages=%lu)\n", + __func__, lo->lo_number, lo->lo_file_name, + lo->lo_device->bd_inode->i_mapping->nrpages); + goto out_unfreeze; + } + + err = loop_set_status_from_info(lo, info); + if (err) + goto out_unfreeze; + if (size_changed) { loff_t new_size = get_size(lo->lo_offset, lo->lo_sizelimit, lo->lo_backing_file); From patchwork Fri Mar 1 01:30:27 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Genjian X-Patchwork-Id: 13577852 Received: from m16.mail.126.com (m16.mail.126.com [117.135.210.9]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 351AB8485; Fri, 1 Mar 2024 01:48:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.9 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709257719; cv=none; b=pbrYsGSqYeVprgGm6oQtS8yXdKUGNHOAsNsS21BB4JncOK8gXRcRwLVLoKdoDYyafb9jE31N2ebd9PR7YSua69JjYN5HMjG9ZPnFkw/HVLprhg3X3c4pSSgC0DtyL/HYHamfYzLCATKvJ+Y1/4/tWgm8a47KbucEPA9/C9FYuSE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709257719; c=relaxed/simple; bh=ddO+vaPFr8wczH7Xw3KlmXH+rU3xHKclnerM9eMBgFQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=mtaX1dfseg+cGn6lORxoNpDBZEr9s55Op9mx3DLLId2wORl/vcSZ8q2zcr1suC18KvOQA4PTfZ+d0TYTq1eb6JWtTg5DW5aLPDlVjnr5TosZkYRrw7NaEFxUrsH/qL3GmiuKxqjpcDZbauBjgjqwwRZh/QOwWp2VCCDaC1SbpEk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=P+q56zxY; arc=none smtp.client-ip=117.135.210.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="P+q56zxY" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=RQsxh LQeP7zTe9uqV+xUV9NFx2bDBH1Lqec4fhz8SUY=; b=P+q56zxYZ6kAWP1DICpoV qdFOzqJNfwmuXIGxDmSN7njlhUS9qfWI79YCpylKgbt4FlWPVYiR6u0P2To9IeHl KpqH9tREyn4FJbk99ZXo0nUyb2g1Kb+PxR18Hv9pqiwwfLb6yYQ2MQSm+M3tKwwK NEcHtQP0KiyxCSy7JXu1rI= Received: from localhost.localdomain (unknown [116.128.244.171]) by gzga-smtp-mta-g1-0 (Coremail) with SMTP id _____wDn7+APMOFlZSfbBA--.18054S12; Fri, 01 Mar 2024 09:32:43 +0800 (CST) From: Genjian To: stable@vger.kernel.org Cc: axboe@kernel.dk, stable@kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, zhanggenjian123@gmail.com, Siddh Raman Pant , syzbot+a8e049cd3abd342936b6@syzkaller.appspotmail.com, Matthew Wilcox , Christoph Hellwig , Genjian Zhang Subject: [PATCH 4.19.y 8/9] loop: Check for overflow while configuring loop Date: Fri, 1 Mar 2024 09:30:27 +0800 Message-Id: <20240301013028.2293831-9-zhanggenjian@126.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240301013028.2293831-1-zhanggenjian@126.com> References: <20240301013028.2293831-1-zhanggenjian@126.com> Precedence: bulk X-Mailing-List: linux-block@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-CM-TRANSID: _____wDn7+APMOFlZSfbBA--.18054S12 X-Coremail-Antispam: 1Uf129KBjvJXoW7Zr1xur4Utw4DAF45AFW5Wrg_yoW8Kw18pF 43WryUZ3yrKF4UCFsrt34kXryrW3WDGFy3G39Fy345u390vrnavry7Cr93ur95JryUZFWS gFn3Jry8Z3WUZrUanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07UHCJQUUUUU= X-CM-SenderInfo: x2kd0wxjhqyxldq6ij2wof0z/1tbi5h+UfmVLY1IzzQAAsy From: Siddh Raman Pant [ Upstream commit c490a0b5a4f36da3918181a8acdc6991d967c5f3 ] The userspace can configure a loop using an ioctl call, wherein a configuration of type loop_config is passed (see lo_ioctl()'s case on line 1550 of drivers/block/loop.c). This proceeds to call loop_configure() which in turn calls loop_set_status_from_info() (see line 1050 of loop.c), passing &config->info which is of type loop_info64*. This function then sets the appropriate values, like the offset. loop_device has lo_offset of type loff_t (see line 52 of loop.c), which is typdef-chained to long long, whereas loop_info64 has lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h). The function directly copies offset from info to the device as follows (See line 980 of loop.c): lo->lo_offset = info->lo_offset; This results in an overflow, which triggers a warning in iomap_iter() due to a call to iomap_iter_done() which has: WARN_ON_ONCE(iter->iomap.offset > iter->pos); Thus, check for negative value during loop_set_status_from_info(). Bug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e Reported-and-tested-by: syzbot+a8e049cd3abd342936b6@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Reviewed-by: Matthew Wilcox (Oracle) Signed-off-by: Siddh Raman Pant Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220823160810.181275-1-code@siddh.me Signed-off-by: Jens Axboe Signed-off-by: Genjian Zhang --- drivers/block/loop.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 0fefd21f0c71..c1caa3e2355f 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1271,6 +1271,11 @@ loop_set_status_from_info(struct loop_device *lo, lo->lo_offset = info->lo_offset; lo->lo_sizelimit = info->lo_sizelimit; + + /* loff_t vars have been assigned __u64 */ + if (lo->lo_offset < 0 || lo->lo_sizelimit < 0) + return -EOVERFLOW; + memcpy(lo->lo_file_name, info->lo_file_name, LO_NAME_SIZE); memcpy(lo->lo_crypt_name, info->lo_crypt_name, LO_NAME_SIZE); lo->lo_file_name[LO_NAME_SIZE-1] = 0; From patchwork Fri Mar 1 01:30:28 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Genjian X-Patchwork-Id: 13577817 Received: from m16.mail.126.com (m16.mail.126.com [220.197.31.8]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 42BC039FCC; Fri, 1 Mar 2024 01:33:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=220.197.31.8 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256794; cv=none; b=Jc64tdtdqU//MKXvYPaoaoFrSKbRJ6T8oURh7uvrhuNwhR9eY+BeJhteZUQonEirMCqEpxa6VHqrnNSDdD7kABXRM5zksvARpK7zq/P/Ramqro85Q9jM+11h1E2ayNAKZbUBXJmebN+YL6ag+UO2iY2ntfhKWstg8iBGBAl8xrg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709256794; c=relaxed/simple; bh=OOhyA6h0GG15G23rni5UZ56kO59KsuBRYJDSMPMsu2U=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=CK6Wswehe29Xau70ypqSHKrfPxy0BjQe0u+IttMqCcocPg2Ez/xqPfFG67enVwQDSz+ClWgs00Bn4kr0GJMsNnxQGq1SCgnISHgxQrXSv73KIE2v+aorrEDGiOrQs61Se8OwED669xUAjZSbZINdHx/uKB0YEKTlrQr4uWfeAcA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=DveyyKxQ; arc=none smtp.client-ip=220.197.31.8 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="DveyyKxQ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=rEEns V7ccavcL1+sORm7vSmbrANTnktlQKRoj9s2el8=; b=DveyyKxQz1UnrBk+8VFfa h1TSkCXtBFV8EXDvf9jDb7bZEK11xdOMFFhyv8cbbYqlIXfijWGsyXi6zbCPDGeb N5jVDOZQcCrVQ5noWsu3RQ3UVf3BfvPtMWB0h2NEqkNoP8pME1395EaKHnU1SgoC ccVal+DZLuXEMHegrFqPrk= Received: from localhost.localdomain (unknown [116.128.244.171]) by gzga-smtp-mta-g1-0 (Coremail) with SMTP id _____wDn7+APMOFlZSfbBA--.18054S13; Fri, 01 Mar 2024 09:32:45 +0800 (CST) From: Genjian To: stable@vger.kernel.org Cc: axboe@kernel.dk, stable@kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, zhanggenjian123@gmail.com, Zhong Jinghua , Chaitanya Kulkarni , Genjian Zhang Subject: [PATCH 4.19.y 9/9] loop: loop_set_status_from_info() check before assignment Date: Fri, 1 Mar 2024 09:30:28 +0800 Message-Id: <20240301013028.2293831-10-zhanggenjian@126.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240301013028.2293831-1-zhanggenjian@126.com> References: <20240301013028.2293831-1-zhanggenjian@126.com> Precedence: bulk X-Mailing-List: linux-block@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-CM-TRANSID: _____wDn7+APMOFlZSfbBA--.18054S13 X-Coremail-Antispam: 1Uf129KBjvJXoW7KF4kJFW5CF47ZFy5AF13Jwb_yoW8ZrW8pa 13Way5C3yFgF48GFsFyry8ZFW5G3ZrGry3WrZrt3WrZr1Ivwna9r9rK34F9rWkJrW3WFWF gFnxXF1vvF1UGw7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07UHCJQUUUUU= X-CM-SenderInfo: x2kd0wxjhqyxldq6ij2wof0z/1tbiyBqUfmWWf0mcQwACsg From: Zhong Jinghua [ Upstream commit 9f6ad5d533d1c71e51bdd06a5712c4fbc8768dfa ] In loop_set_status_from_info(), lo->lo_offset and lo->lo_sizelimit should be checked before reassignment, because if an overflow error occurs, the original correct value will be changed to the wrong value, and it will not be changed back. More, the original patch did not solve the problem, the value was set and ioctl returned an error, but the subsequent io used the value in the loop driver, which still caused an alarm: loop_handle_cmd do_req_filebacked loff_t pos = ((loff_t) blk_rq_pos(rq) << 9) + lo->lo_offset; lo_rw_aio cmd->iocb.ki_pos = pos Fixes: c490a0b5a4f3 ("loop: Check for overflow while configuring loop") Signed-off-by: Zhong Jinghua Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20230221095027.3656193-1-zhongjinghua@huaweicloud.com Signed-off-by: Jens Axboe Signed-off-by: Genjian Zhang --- drivers/block/loop.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index c1caa3e2355f..6050b039e4d2 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1269,13 +1269,13 @@ loop_set_status_from_info(struct loop_device *lo, if (err) return err; + /* Avoid assigning overflow values */ + if (info->lo_offset > LLONG_MAX || info->lo_sizelimit > LLONG_MAX) + return -EOVERFLOW; + lo->lo_offset = info->lo_offset; lo->lo_sizelimit = info->lo_sizelimit; - /* loff_t vars have been assigned __u64 */ - if (lo->lo_offset < 0 || lo->lo_sizelimit < 0) - return -EOVERFLOW; - memcpy(lo->lo_file_name, info->lo_file_name, LO_NAME_SIZE); memcpy(lo->lo_crypt_name, info->lo_crypt_name, LO_NAME_SIZE); lo->lo_file_name[LO_NAME_SIZE-1] = 0;