• Demi Marie Obenour's avatar
    block: increment diskseq on all media change events · b90ecc03
    Demi Marie Obenour authored
    Currently, associating a loop device with a different file descriptor
    does not increment its diskseq.  This allows the following race
    condition:
    
    1. Program X opens a loop device
    2. Program X gets the diskseq of the loop device.
    3. Program X associates a file with the loop device.
    4. Program X passes the loop device major, minor, and diskseq to
       something.
    5. Program X exits.
    6. Program Y detaches the file from the loop device.
    7. Program Y attaches a different file to the loop device.
    8. The opener finally gets around to opening the loop device and checks
       that the diskseq is what it expects it to be.  Even though the
       diskseq is the expected value, the result is that the opener is
       accessing the wrong file.
    
    From discussions with Christoph Hellwig, it appears that
    disk_force_media_change() was supposed to call inc_diskseq(), but in
    fact it does not.  Adding a Fixes: tag to indicate this.  Christoph's
    Reported-by is because he stated that disk_force_media_change()
    calls inc_diskseq(), which is what led me to discover that it should but
    does not.
    Reported-by: default avatarChristoph Hellwig <hch@infradead.org>
    Signed-off-by: default avatarDemi Marie Obenour <demi@invisiblethingslab.com>
    Fixes: e6138dc1 ("block: add a helper to raise a media changed event")
    Cc: stable@vger.kernel.org # 5.15+
    Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
    Link: https://lore.kernel.org/r/20230607170837.1559-1-demi@invisiblethingslab.comSigned-off-by: default avatarJens Axboe <axboe@kernel.dk>
    b90ecc03
disk-events.c 12.9 KB