Re: SYZKALLER BUG: messing with a mounted file system via loop ioctls (was: Re: [PATCH] ext4: add bounds check in ext4_xattr_ibody_get() to) prevent out-of-bounds access

[Theodore Tso]

On Sun, Mar 29, 2026 at 11:47:44AM +0200, Dmitry Vyukov wrote:
> Thanks for the report.
> 
> https://syzkaller.appspot.com/text?tag=ReproSyz&x=17a43b3a580000
> 
> Do you mean LOOP_SET_STATUS64 ioctl? It's the only ioctl in the repro:
> 
> ioctl$LOOP_SET_STATUS64(r0, 0x4c04, ...)

The loop LOOP_SET_STATUS ioctl is also problematic.

> Does it mean it should also be prohibited under
> CONFIG_BLK_DEV_WRITE_MOUNTED to avoid kernel memory corruption?
> Or at least some changes should be prohibited? E.g. I guess changing
> lo_offset is equivalent to writing to the mounted device.

Yes, that's correct.  LOOP_SET_STATUS[64] can set lo_offset and
lo_sizelimit which effectively mutates the loop device while it is
mounted.

The fix is something like:

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 0000913f7efc..c1d17e2bbd0c 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1238,6 +1238,16 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
 		err = -ENXIO;
 		goto out_unlock;
 	}
+#ifndef CONFIG_BLK_DEV_WRITE_MOUNTED)
+	/*
+	 * bdev_writes_blocked is a static function defiend in
+	 * block/bdev.c, so this won't work as-is.
+	 */
+	if (bdev_writes_blocked(lo->lo_device)) {
+		err = -EBUSY;
+		goto out_unlock;
+	}
+#endif
 
 	if (lo->lo_offset != info->lo_offset ||
 	    lo->lo_sizelimit != info->lo_sizelimit) {

Turning this into a real patch that exports bdev_writes_blocked() is
left as an exercise to the reader.

					- Ted