Re: 2.6.13: loop ioctl crashes

[linux-os (Dick Johnson)]

On Fri, 9 Sep 2005, Ian Collier wrote:

> On Fri, Sep 09, 2005 at 08:32:10AM -0400, linux-os (Dick Johnson) wrote:
>> I guess you are trying to do a copy_from_user() with a spin-lock
>> being held or the interrupts otherwise disabled. You can hold
>> a semaphore, to prevent somebody else from interfering with
>> you, but you cannot hold a spin-lock during copy/to/from/user().
>
> Well, I didn't write the code (it's right there in drivers/block/loop.c
> in 2.6.13) and I can't see where there's a spin-lock.  In fact it does
> use a semaphore.
>
> imc
> -

Try to see if it is really the loop device or something that is
interfacing with it. Here I copy the contents of a DOS floppy
to a file, then mount the file through the loop device:

Script started on Fri 09 Sep 2005 10:17:27 AM EDT
[root@chaos driver]# cp /dev/fd0 image
[root@chaos driver]# ls -la image
-rw-r-----  1 root root 1474560 Sep  9 10:18 image
[root@chaos driver]# mount -o loop image /mnt
[root@chaos driver]# ls -la /mnt
total 894
drwxr-xr-x   2 root root   7168 Dec 31  1969 .
drwxr-xr-x  26 root root   4096 Sep  9 08:41 ..
-rwxr-xr-x   1 root root    170 Apr 10  2003 autoexec.bat
-rwxr-xr-x   1 root root  86413 Jul 30  2002 command.com
-rwxr-xr-x   1 root root   2882 Apr  9  2003 config.sys
-rwxr-xr-x   1 root root  16967 Mar 27  2003 err_lev.bat
-rwxr-xr-x   1 root root   5874 Jan 21  2002 fdxxms.sys
-rwxr-xr-x   1 root root   3173 Mar 27  2003 findramd.exe
-rwxr-xr-x   1 root root  41293 Aug  4  2002 kernel.sys
-rwxr-xr-x   1 root root 719592 Jun 28  2004 sw.exe
-rwxr-xr-x   1 root root  25084 Sep 28  2000 tdsk.exe
[root@chaos driver]# umount /mnt
[root@chaos driver]# exit

Script done on Fri 09 Sep 2005 10:18:55 AM EDT



This seems to work okay in 2.6.13, however I don't think it
__should__ work because in lo_ioctl(), the following
functions reference 'arg' without using copy/to/from/user() or
put/get/user():
 	loop_set_fd (vi fget()),
 	loop_change_fd (via fget()),
 	loop_get_status (via memset() and others),
 	loop_get_status_old,
 	loop_set_status64,
 	loop_get_status64,
         ... etc.

Basically, anything that uses ioctl() on the loop device may find
that they crash the system. This code is broken.

Anton Altaparmakov last 'touched' that code in Feb 2005. Maybe
he can fix the ioctl procedure to use the correct interface to
user-land????


Cheers,
Dick Johnson
Penguin : Linux version 2.6.13 on an i686 machine (5589.53 BogoMips).
Warning : 98.36% of all statistics are fiction.
.
I apologize for the following. I tried to kill it with the above dot :

****************************************************************
The information transmitted in this message is confidential and may be privileged.  Any review, retransmission, dissemination, or other use of this information by persons or entities other than the intended recipient is prohibited.  If you are not the intended recipient, please notify Analogic Corporation immediately - by replying to this message or by sending an email to DeliveryErrors@xxxxxxxxxxxx - and destroy all copies of this information, including any attachments, without reading or disclosing them.

Thank you.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/