From nobody Thu Apr 2 10:44:29 2026 Received: from mail-oa1-f71.google.com (mail-oa1-f71.google.com [209.85.160.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB4A52A1BF for ; Mon, 30 Mar 2026 01:43:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.71 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774834999; cv=none; b=COwNa3N6M3NcjsjY2/DbqwmJA/D9OjN/6ufr5+vayFxEQHpfjjSPtXBsEXC+aaKvecnGc2LSQMPA3WTnxxFammrm5w8guuCfrhByEY3CImqUdrBCC53cCxZzx/BHVxGw/RLtEFINVG/y3jP8JEqSoYh3+ulAzSo4VdcFqBSv8+o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774834999; c=relaxed/simple; bh=AUKZrvrWyFIP4wKvQGb7ZbK9TlIsQd9oXYfNkCWbTh4=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=VA+hLuUMe9YcyIrFpyOEALmSYBc1gL3+1Op3KL9sy0YkehYPerQD2CQVSGsIk9OvI/fd5YCkiAuut0ZzFbxDJEZrfZJ48ytCov7TjdS8hmxSBH8Ll9g7FfpLKxK6jg69ReorFoSKWwB5nXR0DBar/CauAc9IFR++9YOeUi1EDgY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.160.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oa1-f71.google.com with SMTP id 586e51a60fabf-415e1e9aa5dso10277147fac.0 for ; Sun, 29 Mar 2026 18:43:17 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774834997; x=1775439797; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=QgZRjYTW7ppfMvYttNfT7zOqY4NSPjR5Pt6nONGydjs=; b=mPACISNKPXiJirOQ/xDcB2yKpkKp/vLN96SODk6Yi593xBcSau4Xx/fdx+62p/1mYR xT6Se2Sgg/Do3bFzu79jMLk1wSKIxUY3dBkvdZ0hHGXwSV9+9ELin1/uHyeWaVP8W8iT myXUSPpzlw8srGvhzEhnkpW5b8ztilan/UJzCLv26bnX9uFglGDnBDOHOWkAirNmHjxN VP9qIwEdBltWvLqoEi7K/s4blNNB/wHe91N4xPNpfk66P3gp2tG4tPlDFLiwUI7gvL1l 8L3X4nmBQFowotjXUAQgPt0C/JmwbQ9W9ob7LqBqmTC9s/x6JzIGm33JZUNNaQ6QglAi tIog== X-Gm-Message-State: AOJu0YxW8i7f3T81Q342yCV+9+ubNxBBx+tVqNUTyEUkVoqdq2V9Kv6I n7F220R5k6EWQenC1eyV8QIec4sqNQicanVvDy+FcGEoEKFbRh4YRromYTRIij0OwqnTP8P330w PZBQXGsnufTgp3Ju6FMgj7OnQUt5Hx4h+Z7Jk3g2mHiE44BgYKmQk1nitP3o= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:228c:b0:67b:c7a0:e4ec with SMTP id 006d021491bc7-67e18639c9amr5680218eaf.22.1774834996895; Sun, 29 Mar 2026 18:43:16 -0700 (PDT) Date: Sun, 29 Mar 2026 18:43:16 -0700 In-Reply-To: <699b9b6f.a70a0220.2c38d7.0189.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <69c9d534.a70a0220.97f31.0101.GAE@google.com> Subject: Forwarded: [PATCH] loop: block loop reconfiguration of offset/sizelimit on mounted device From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] loop: block loop reconfiguration of offset/sizelimit on mo= unted device Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git= master LOOP_SET_STATUS{64} allows changing lo_offset and lo_sizelimit while a filesystem is mounted on the loop device. This effectively mutates the data visible to the mounted filesystem, which is equivalent to writing directly to the block device. When bdev_allow_write_mounted is false, direct writes to a mounted block device are blocked via bdev_writes_blocked(). However, LOOP_SET_STATUS{64} bypasses this protection because it modifies the loop configuration through an ioctl rather than opening the block device for writing. Fix this by checking bdev_writes_blocked() before allowing changes to lo_offset or lo_sizelimit. If the loop device has writes blocked (indicating a filesystem is mounted with write protection), return -EBUSY. Other loop status fields that do not affect the visible data can still be changed while mounted. Export bdev_writes_blocked() so it can be used from the loop driver. Suggested-by: Theodore Ts'o Reported-by: syzbot+fb32afec111a7d61b939@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Dfb32afec111a7d61b939 Signed-off-by: Deepanshu Kartikey --- block/bdev.c | 4 +++- drivers/block/loop.c | 12 ++++++++++++ include/linux/blkdev.h | 1 + 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/block/bdev.c b/block/bdev.c index ed022f8c48c7..96520fac7b2f 100644 --- a/block/bdev.c +++ b/block/bdev.c @@ -860,10 +860,12 @@ void blkdev_put_no_open(struct block_device *bdev) put_device(&bdev->bd_device); } =20 -static bool bdev_writes_blocked(struct block_device *bdev) +bool bdev_writes_blocked(struct block_device *bdev) { return bdev->bd_writers < 0; } +EXPORT_SYMBOL_GPL(bdev_writes_blocked); + =20 static void bdev_block_writes(struct block_device *bdev) { diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 0000913f7efc..3f3a29abad1f 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1239,6 +1239,18 @@ loop_set_status(struct loop_device *lo, const struct= loop_info64 *info) goto out_unlock; } =20 + /* + * Changing lo_offset or lo_sizelimit on a mounted device is + * equivalent to modifying the block device contents, block + * this if writes are blocked on the device. + */ + if ((lo->lo_offset !=3D info->lo_offset || + lo->lo_sizelimit !=3D info->lo_sizelimit) && + bdev_writes_blocked(lo->lo_device)) { + err =3D -EBUSY; + goto out_unlock; + } + if (lo->lo_offset !=3D info->lo_offset || lo->lo_sizelimit !=3D info->lo_sizelimit) { size_changed =3D true; diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index d463b9b5a0a5..6b908e9dd035 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -820,6 +820,7 @@ static inline bool bdev_read_only(struct block_device *= bdev) return bdev_test_flag(bdev, BD_READ_ONLY) || get_disk_ro(bdev->bd_disk); } =20 +bool bdev_writes_blocked(struct block_device *bdev); bool set_capacity_and_notify(struct gendisk *disk, sector_t size); void disk_force_media_change(struct gendisk *disk); void bdev_mark_dead(struct block_device *bdev, bool surprise); --=20 2.43.0