[PATCH] loop: check for read-write open mode on LOOP_SET_STATUS in lo_compat_ioctl()

[PATCH] loop: check for read-write open mode on LOOP_SET_STATUS in lo_compat_ioctl()

[Dominik Maier]

In 64-bit lo_ioctl(), commit 7035b5df3c07 ("loop: cleanup set_status
interface") added a check requiring (mode & FMODE_WRITE) ||
capable(CAP_SYS_ADMIN) (now BLK_OPEN_WRITE) before allowing
LOOP_SET_STATUS or LOOP_SET_STATUS64, but the corresponding check was
omitted from 32-bit lo_compat_ioctl().

As a result, on kernels with CONFIG_COMPAT=y, an unprivileged process
holding a read-only (O_RDONLY) file descriptor to an active /dev/loopN
device can issue a 32-bit compat LOOP_SET_STATUS ioctl to modify
lo_offset, clear lo_sizelimit to 0 (exposing backing-file data past the
configured limit), or alter lo_flags.

Enforce the same (mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN) check
on LOOP_SET_STATUS in lo_compat_ioctl().

Fixes: 7035b5df3c07 ("loop: cleanup set_status interface")
Assisted-by: ARTIST LLM
Signed-off-by: Dominik Maier <dmnk@google.com>
---
 drivers/block/loop.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 758c20678bf6..f15a5cae5c63 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1708,8 +1708,10 @@ static int lo_compat_ioctl(struct block_device *bdev, blk_mode_t mode,
 
 	switch(cmd) {
 	case LOOP_SET_STATUS:
-		err = loop_set_status_compat(lo,
-			     (const struct compat_loop_info __user *)arg);
+		err = -EPERM;
+		if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN))
+			err = loop_set_status_compat(lo,
+				(const struct compat_loop_info __user *)arg);
 		break;
 	case LOOP_GET_STATUS:
 		err = loop_get_status_compat(lo,
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH] loop: check for read-write open mode on LOOP_SET_STATUS in lo_compat_ioctl()

[Bart Van Assche]

On 10/22/26 4:21 PM, Dominik Maier wrote:
 > In 64-bit lo_ioctl(), commit 7035b5df3c07 ("loop: cleanup set_status
 > interface") added a check requiring (mode & FMODE_WRITE) ||
 > capable(CAP_SYS_ADMIN) (now BLK_OPEN_WRITE) before allowing
 > LOOP_SET_STATUS or LOOP_SET_STATUS64, but the corresponding check was
 > omitted from 32-bit lo_compat_ioctl().

In the Linux kernel compat ioctl handlers allow 32-bit user-space 
applications to use ioctl() interfaces when running on a 64-bit kernel. 
They provide compatibility between the data layouts and calling 
conventions of 32-bit applications and the 64-bit kernel.
Hence, the above description is not correct. Please consider
rephrasing this as "lo_ioctl() ... but not lo_compat_ioctl(), the
handler used by 32-bit user space on 64-bit kernels".

 > Fixes: 7035b5df3c07 ("loop: cleanup set_status interface")

Commit 7035b5df3c07 is not the commit that introduced the bug fixed by
this patch. Since this bug may be as old as the loop driver, please
remove the Fixes: tag and add a Cc: stable@vger.kernel.org tag.

Thanks,

Bart.