From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.218.49 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794563700; b=XeyZLA60EzTV3rJXXUvqIETTvegADilLs5A4d/Ua0lsf3WY9UtCxCqKZJiAKWXrWTUqi OWbPZUcyKGaqEf9XJOjIDu520nftLCa5njn8zo5BcwPwR1ZzsHNvTyzxYFtl7R2j6RPve Ab8lh32RfKTmIZVJahz1BK9/FBRrEAz/zg5tWm58KaiiyvFruwQFxMyWtkR1u9gufPYQ9 JVbjgDfEEtyl8y2wVMEv6UbFwXNIOjCu+To/ERS46OErFa4hZULGOB+PbFwr6xrUdV3Mr lBioh9ngKNn5AOVOUTtAlf5RnTtLpTc6JYEYZgOOZ6bLMKUL1qwfBaIp8OajR85CfdQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794563700; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:Content-Transfer-Encoding:User-Agent:MIME-Version; bh=G8DmFU4pJwAPCJlqHBF8SKasEEThxtJNlC1sg/CSkLw=; b=TbKQO4mxg1ttD71cFNhxawgfHGGmA+0JbWl82NhcBb8PvT4HvXN/Oeup6JwEdb6FPxLS KoJ8rFHd/8gJxsnt9g1jkobllw0Qxgs9Ca1JE/90avPoGGBSlRMljm1BoqEwPSXEScBlB rxnyz/FW7KOgunW6HG45QlIbC9btBYj3mS7jUgBVLMN7xl3qzRj3iogeSL7576vWwnZ1F LCTQayhRoE2dZzgIqmxvQH7gdZSzcB+0zbu5+cmrRNze4DA87oA+HJUPFENd08OrPeiXn xz/9wAsciqsLA6H/SofpoBsdOlHJWf52MBtHs/ejtQsLzSBOeakW/Hp+qM+iwFgufkA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none header.from=amutable.com; spf=pass smtp.mailfrom=amutable.com; dkim=pass header.d=amutable-com.20260707.gappssmtp.com header.i=@amutable-com.20260707.gappssmtp.com header.a=rsa-sha256 header.s=20260707 header.b=sk58W6sW; arc=none smtp.remote-ip=209.85.218.49 Received: from mail-ej1-f49.google.com (mail-ej1-f49.google.com [209.85.218.49]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 46A3660A2609 for ; Fri, 13 Nov 2026 09:55:00 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 46A3660A2609 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=amutable.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amutable.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amutable-com.20260707.gappssmtp.com header.i=@amutable-com.20260707.gappssmtp.com header.a=rsa-sha256 header.s=20260707 header.b=sk58W6sW Received: by mail-ej1-f49.google.com with SMTP id a640c23a62f3a-c3f04e0e65fso169260566b.2 for ; Fri, 13 Nov 2026 01:54:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amutable-com.20260707.gappssmtp.com; s=20260707; t=1794563698; x=1795168498; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:content-type :references:in-reply-to:date:cc:to:from:subject:message-id:from:to :cc:subject:date:message-id:reply-to:content-type; bh=G8DmFU4pJwAPCJlqHBF8SKasEEThxtJNlC1sg/CSkLw=; b=sk58W6sWmN4ERo+6S+koVh/BM/TVuc998Smvb7+dAHAHasLoIxA1PyH7SpTb2sphTs qaL8BceJIK/C5zTluK59TXAg0t7i18MIhSXKzAc74GDtFkVBtJ5XexxofTn2ErTCpEyw wBL0ZIwSoD+QdFLNUYuAtp3uhttIIU+8CcgeY50Q9BuPcdVkRSxffNnvhBi5q+TOT3Z0 N0fPVcnw8avDa7R0wdKzwUNoVC/3vPRCD1SmgKjZfrkNv7BBIugYP8aqCryl3mRTzhIm nyzLSOhSkS/Bye+QA00IM2MsjhnUA408QIyungJaHYxvuyXbuTeC6K0dJcKnUnQNsCLo BJGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794563698; x=1795168498; h=mime-version:user-agent:content-transfer-encoding:content-type :references:in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=G8DmFU4pJwAPCJlqHBF8SKasEEThxtJNlC1sg/CSkLw=; b=AKNRSyf8z88+jykkfJ3ImmPl3zBR2a1BEe6bvDpCaeo/GYYACChxhzMkQEMjmqPWqX od0MKsy820wuNpjSgx7NVIn5K7sqlyhKWOXH4LHJmPd0BzKKMMjzEE840ssEvARtGhxl khEZG6ZmjBooWhX95EwXrBWg3f5eIyl7jam8m6JBzkI5vpUOUM2Eg6pT0U4Ai15IQ4s+ VmSRGzAB274DddXaGhcH4OZ0HhRkdldPJELj9AEqGMvgMwg9Ibug7yXTjVnLWwfWqpzE i1+hsQE5CHbpTw8w06i/0U3ssinbw94fkS3H3Z3rlc5iWCp3508KYW75b3S7acI52WO7 +Kxw== X-Forwarded-Encrypted: i=1; AL+hErHYx6FWN9dPyXzYZkVrXt4gRb6zRh2n5OH3IVqPyb9UQ6bb/Ga3stSqg+zqp0mJaY3U5dixPOsth/A/pEMM7QypJGk7uCc=@vger.kernel.org X-Gm-Message-State: APuU4Z+0bnxxa6UbG5X7AADrm/wlZkRklAHd5z4ZTbnhayZXz/g3NKsm d4QMd4iNpBPWMPlc0/5qkphs7e/A8fjed9v1HeiLuXki4th2AXPFvJn05BJmfsBdZVgk X-Gm-Gg: AYBFou1tpwKt0qDqXWqnza3EPDxweAztRHASZl5duftvZ6SlEzV7P9hOAfgiBLyiF6t j8Fhe13dIkN+ihZRlZkMOr2hVldRfrdMw9x6+zyrpadx39EWZfD+wMA1GhY+7cxqzOKVWWZ0K/g /5tSr7yCQEMS86tQk3a3xCT2OhG1bVIPLxiBv6PB0pxn92xOLzJtT7PZcXgZTWrdCsGdXnbIq71 x3YFoxBP2ejPfN0ZgO9VA6uAlguDh71hr5jtAZdGn/GjKQcoJEu0qelmY4OvGrjp8LZ1sTqsOBx 2bhoJZMHQ5jUhLSoXq0GhIMjGTAlr7NXsduGTSQunqRsVXz7Ld/GQEIK8TGgc/TZhLyxtSfhUZd OSf2OKRroZC/vwxEPJYq63H72aBpqEWBsHIeaNszsw6lwNFYjcHlBSamDGD7Qh0nHEkSylADD+H VdD1ADIKs9pBQXTLyq1R2kVz2eJa4mD8YLLBQijVNNG2kIzVCJQDSCgGCuFcBkzVlqVtbE8tbCG UxKiraryo3liykSd+YxVTVYLUhSSEFpQjswBfwtrUka4NScnHGv48O/ZNDm5GUz6mwMCNYedEEu Jp8YZcTRAosOrxGKRfPeGceJzw9eeBVc0ft+z/dbKGv1cef3vy8nx3B0xLReO18= X-Received: by 2002:a17:907:ea93:b0:c41:4c20:5a80 with SMTP id a640c23a62f3a-c50963bdb9bmr198299566b.44.1794563698514; Fri, 13 Nov 2026 01:54:58 -0800 (PST) Received: from [10.0.0.233] (tmo-086-54.customers.d1-online.com. [80.187.86.54]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c50957c6c1fsm75151566b.0.2026.11.13.01.54.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 13 Nov 2026 01:54:58 -0800 (PST) Message-ID: Subject: Re: [PATCH RFC 01/41] loop: refuse backing files that aren't open for reading From: Alexander Mikhalitsyn To: Christian Brauner , linux-fsdevel@vger.kernel.org Cc: Jann Horn , Chris Mason , Josef Bacik , Christoph Hellwig , linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, linux-nvme@lists.infradead.org, Alexander Viro , Jan Kara , linux-scsi@vger.kernel.org, target-devel@vger.kernel.org, driver-core@lists.linux.dev, linux-mm@kvack.org, bpf@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org, apparmor@lists.ubuntu.com, linux-nfs@vger.kernel.org, netdev@vger.kernel.org, fuse-devel@lists.linux.dev, linux-efi@vger.kernel.org, xen-devel@lists.xenproject.org, ocfs2-devel@lists.linux.dev, linux-s390@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-usb@vger.kernel.org, Amir Goldstein , linux-erofs@lists.ozlabs.org, linux-kselftest@vger.kernel.org, stable@vger.kernel.org Date: Fri, 13 Nov 2026 10:54:56 +0100 In-Reply-To: <20261110-work-loop-pseudo-v1-1-4c998976c6c7@kernel.org> References: <20261110-work-loop-pseudo-v1-0-4c998976c6c7@kernel.org> <20261110-work-loop-pseudo-v1-1-4c998976c6c7@kernel.org> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.56.2-0+deb13u1 X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 On Tue, 2026-11-10 at 10:14 +0100, Christian Brauner wrote: > loop_configure() takes any file as long as it implements - > >read_iter(). > Loop itself never checked whether the file was actually opened for > reading. Buffered I/O went through vfs_iter_read() which refuses > files > without FMODE_READ. Direct I/O has called ->read_iter() of the > backing > file directly ever since loop grew support for it. >=20 > Since commit f2fed441c69b ("loop: stop using vfs_iter_{read,write} > for > buffered I/O") buffered I/O calls ->read_iter() directly as well. > That > commit was about O_DIRECT handling and the FMODE_READ check went away > as a side effect. >=20 > So whoever can set up a loop device can read a file it was only > allowed > to open for writing. Open the file O_WRONLY, configure a loop device > with it and read the contents through the loop device. >=20 > Refuse backing files that aren't open for reading. Loop always reads > from its backing file so a write-only backing file never made sense > in > the first place. >=20 > Fixes: bc07c10a3603 ("block: loop: support DIO & AIO") > Fixes: f2fed441c69b ("loop: stop using vfs_iter_{read,write} for > buffered I/O") > Cc: stable@vger.kernel.org > Signed-off-by: Christian Brauner (Amutable) Reviewed-by: Alexander Mikhalitsyn > --- > =C2=A0drivers/block/loop.c | 3 +++ > =C2=A01 file changed, 3 insertions(+) >=20 > diff --git a/drivers/block/loop.c b/drivers/block/loop.c > index a3325ceab484..c96e35c3ef42 100644 > --- a/drivers/block/loop.c > +++ b/drivers/block/loop.c > @@ -528,6 +528,9 @@ static void loop_assign_backing_file(struct > loop_device *lo, struct file *file) > =C2=A0 > =C2=A0static int loop_check_backing_file(struct file *file) > =C2=A0{ > + if (!(file->f_mode & FMODE_READ)) > + return -EBADF; > + > =C2=A0 if (!file->f_op->read_iter) > =C2=A0 return -EINVAL; > =C2=A0