Re: [PATCH] loop: prohibit the use of sysfs as a backing file

[Bart Van Assche]

On 11/2/26 2:33 AM, Edward Adam Davis wrote:
> diff --git a/drivers/block/loop.c b/drivers/block/loop.c
> index a3325ceab484..71647793a717 100644
> --- a/drivers/block/loop.c
> +++ b/drivers/block/loop.c
> @@ -534,6 +534,9 @@ static int loop_check_backing_file(struct file *file)
>   	if ((file->f_mode & FMODE_WRITE) && !file->f_op->write_iter)
>   		return -EINVAL;
>   
> +	if (file_inode(file)->i_sb->s_magic == SYSFS_MAGIC)
> +		return -EINVAL;

Recently Christoph Hellwig asked not to make this type of changes. From
https://lore.kernel.org/all/20260601071058.GA7468@xxxxxx/: "NAK. If
people want to do these stupid things we should allow it. Hardcoding
random superblock magics in random drivers is never a good idea."

The minimal reproducer for the syzbot report is as follows:

mkdirat(AT_FDCWD, "./sys", 0777);
mount(NULL, "./sys", "sysfs", 0, NULL);
r0 = open("/dev/loop0", O_RDWR);
r1 = openat(AT_FDCWD, "./sys/block/loop0/queue/scheduler", O_CREAT | 
O_RDWR, 0777);
ioctl(r0, LOOP_SET_FD, r1);
write(r0, "\x00" /* x 4096 */, 4096);
/* process exit closes r0 */

A possible fix for this syzbot bug report is to extend
loop_validate_file() such that it also refuses to bind loop devices
to sysfs attributes associated to the loop block device.

Bart.