Re: [PATCH 2/2] [RFC]: block: count BLK_OPEN_RESTRICT_WRITES openers

[Jan Kara <jack@suse.cz>]

On Sat 23-03-24 17:11:20, Christian Brauner wrote:
> The original changes in v6.8 do allow for a block device to be reopened
> with BLK_OPEN_RESTRICT_WRITES provided the same holder is used as per
> bdev_may_open(). I think that may have a bug.
		   		^^^^^^^^ is :)
Also AFAICT this can happen only the the reopen is O_RDONLY which would be
probably good to mention here.

> The first opener @f1 of that block device will set bdev->bd_writers to
> -1. The second opener @f2 using the same holder will pass the check in
> bdev_may_open() that bdev->bd_writers must not be greater than zero.
> 
> The first opener @f1 now closes the block device and in bdev_release()
> will end up calling bdev_yield_write_access() which calls
> bdev_writes_blocked() and sets bdev->bd_writers to 0 again.
> 
> Now @f2 holds a file to that block device which was opened with
> exclusive write access but bdev->bd_writers has been reset to 0.
> 
> So now @f3 comes along and succeeds in opening the block device with
> BLK_OPEN_WRITE betraying @f2's request to have exclusive write access.
> 
> This isn't a practical issue yet because afaict there's no codepath
> inside the kernel that reopenes the same block device with
> BLK_OPEN_RESTRICT_WRITES but it will be if there is.
> 
> If that's right then fix this by counting the number of
> BLK_OPEN_RESTRICT_WRITES openers. So we only allow writes again once all
> BLK_OPEN_RESTRICT_WRITES openers are done.
> 
> Fixes: ed5cc702d311 ("block: Add config option to not allow writing to mounted devices")
> Signed-off-by: Christian Brauner <brauner@kernel.org>

Otherwise looks good so feel free to add:

Reviewed-by: Jan Kara <jack@suse.cz>

								Honza

> ---
>  block/bdev.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/block/bdev.c b/block/bdev.c
> index f819f3086905..42f84692404c 100644
> --- a/block/bdev.c
> +++ b/block/bdev.c
> @@ -776,17 +776,17 @@ void blkdev_put_no_open(struct block_device *bdev)
>  
>  static bool bdev_writes_blocked(struct block_device *bdev)
>  {
> -	return bdev->bd_writers == -1;
> +	return bdev->bd_writers < 0;
>  }
>  
>  static void bdev_block_writes(struct block_device *bdev)
>  {
> -	bdev->bd_writers = -1;
> +	bdev->bd_writers--;
>  }
>  
>  static void bdev_unblock_writes(struct block_device *bdev)
>  {
> -	bdev->bd_writers = 0;
> +	bdev->bd_writers++;
>  }
>  
>  static bool bdev_may_open(struct block_device *bdev, blk_mode_t mode)
> -- 
> 2.43.0
> 
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR