Re: SYZKALLER BUG: messing with a mounted file system via loop ioctls (was: Re: [PATCH] ext4: add bounds check in ext4_xattr_ibody_get() to) prevent out-of-bounds access

[Deepanshu Kartikey]

On Sun, Mar 29, 2026 at 7:18 PM Theodore Tso <tytso@xxxxxxx> wrote:
>
> On Sun, Mar 29, 2026 at 11:47:44AM +0200, Dmitry Vyukov wrote:
> > Thanks for the report.
> >
> > https://syzkaller.appspot.com/text?tag=ReproSyz&x=17a43b3a580000
> >
> > Do you mean LOOP_SET_STATUS64 ioctl? It's the only ioctl in the repro:
> >
> > ioctl$LOOP_SET_STATUS64(r0, 0x4c04, ...)
>
> The loop LOOP_SET_STATUS ioctl is also problematic.
>
> > Does it mean it should also be prohibited under
> > CONFIG_BLK_DEV_WRITE_MOUNTED to avoid kernel memory corruption?
> > Or at least some changes should be prohibited? E.g. I guess changing
> > lo_offset is equivalent to writing to the mounted device.
>
> Yes, that's correct.  LOOP_SET_STATUS[64] can set lo_offset and
> lo_sizelimit which effectively mutates the loop device while it is
> mounted.
>
> The fix is something like:
>
> diff --git a/drivers/block/loop.c b/drivers/block/loop.c
> index 0000913f7efc..c1d17e2bbd0c 100644
> --- a/drivers/block/loop.c
> +++ b/drivers/block/loop.c
> @@ -1238,6 +1238,16 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
>                 err = -ENXIO;
>                 goto out_unlock;
>         }
> +#ifndef CONFIG_BLK_DEV_WRITE_MOUNTED)
> +       /*
> +        * bdev_writes_blocked is a static function defiend in
> +        * block/bdev.c, so this won't work as-is.
> +        */
> +       if (bdev_writes_blocked(lo->lo_device)) {
> +               err = -EBUSY;
> +               goto out_unlock;
> +       }
> +#endif
>
>         if (lo->lo_offset != info->lo_offset ||
>             lo->lo_sizelimit != info->lo_sizelimit) {
>
> Turning this into a real patch that exports bdev_writes_blocked() is
> left as an exercise to the reader.
>
>                                         - Ted



Hi Ted and Dmitry

Thanks for the sketch. I'll look into turning this into a proper
patch, exporting bdev_writes_blocked() and fixing up the
LOOP_SET_STATUS path.

Deepanshu