[PATCH] loop: prohibit the use of sysfs as a backing file

[Edward Adam Davis]

The loop driver's backing file validation in loop_validate_file() and
loop_check_backing_file() only checks for the presence of read_iter/
write_iter operations, S_ISREG/S_ISBLK inode mode, and direct loop-to-loop
device recursion. Because sysfs/kernfs attribute files are regular files
(S_IFREG) and implement read_iter/write_iter, a loop device can be configured
with its own sysfs queue attribute (such as /sys/block/loop0/queue/scheduler)
as its backing file. When an I/O request is submitted to the loop device,
loop_workfn processes the request while holding a reference on the queue's
q->q_usage_counter and writes to the sysfs file via lo_rw_aio(). The sysfs
write handler (elv_iosched_store -> elevator_change -> blk_mq_freeze_queue)
then attempts to freeze the loop device's own queue, waiting indefinitely
in blk_mq_freeze_queue_wait() for q->q_usage_counter to reach zero, causing
an unresolvable self-deadlock, potentially hitting:

INFO: task kworker/u8:1:13 blocked for more than 143 seconds.
Call trace:
 blk_mq_freeze_queue_wait+0xe0/0x160 block/blk-mq.c:191
 blk_mq_freeze_queue_nomemsave+0x28/0x38 block/blk-mq.c:207
 blk_mq_freeze_queue include/linux/blk-mq.h:956 [inline]
 elevator_change+0x174/0x35c block/elevator.c:668
 elv_iosched_store+0x2a8/0x3bc block/elevator.c:826
 queue_attr_store+0x1c0/0x24c block/blk-sysfs.c:906
 sysfs_kf_write+0xe0/0x108 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345
 lo_rw_aio+0xaa0/0xd04 include/linux/percpu-rwsem.h:-1
 do_req_filebacked drivers/block/loop.c:-1 [inline]
 loop_handle_cmd drivers/block/loop.c:1949 [inline]

Add a sysfs file check to prevent loop devices from using such files
as backing files.

Reported-by: syzbot+a31cda410a4ccd419712@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=a31cda410a4ccd419712
Signed-off-by: Edward Adam Davis <eadavis@xxxxxxxx>
---
 drivers/block/loop.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index a3325ceab484..71647793a717 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -534,6 +534,9 @@ static int loop_check_backing_file(struct file *file)
 	if ((file->f_mode & FMODE_WRITE) && !file->f_op->write_iter)
 		return -EINVAL;
 
+	if (file_inode(file)->i_sb->s_magic == SYSFS_MAGIC)
+		return -EINVAL;
+
 	return 0;
 }
 
-- 
2.43.0