Re: [PATCH] loop: check for read-write open mode on LOOP_SET_STATUS in lo_compat_ioctl()

[Bart Van Assche <bvanassche@acm.org>]

On 10/22/26 4:21 PM, Dominik Maier wrote:
 > In 64-bit lo_ioctl(), commit 7035b5df3c07 ("loop: cleanup set_status
 > interface") added a check requiring (mode & FMODE_WRITE) ||
 > capable(CAP_SYS_ADMIN) (now BLK_OPEN_WRITE) before allowing
 > LOOP_SET_STATUS or LOOP_SET_STATUS64, but the corresponding check was
 > omitted from 32-bit lo_compat_ioctl().

In the Linux kernel compat ioctl handlers allow 32-bit user-space 
applications to use ioctl() interfaces when running on a 64-bit kernel. 
They provide compatibility between the data layouts and calling 
conventions of 32-bit applications and the 64-bit kernel.
Hence, the above description is not correct. Please consider
rephrasing this as "lo_ioctl() ... but not lo_compat_ioctl(), the
handler used by 32-bit user space on 64-bit kernels".

 > Fixes: 7035b5df3c07 ("loop: cleanup set_status interface")

Commit 7035b5df3c07 is not the commit that introduced the bug fixed by
this patch. Since this bug may be as old as the loop driver, please
remove the Fixes: tag and add a Cc: stable@vger.kernel.org tag.

Thanks,

Bart.