Re: [patch 260/266] loop: add ioctl to resize a loop device

On Tue, 6 Jan 2009 15:58:19 -0800 (PST)
Linus Torvalds [off-list ref] wrote:

On Tue, 6 Jan 2009, akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org wrote:

quoted

Add the ability to 'resize' the loop device on the fly.

Hell no.

There is apparently no security checking here. No way can we allow this 
for any random user that can open the loopback device read-only and then 
just change its size.

It needs to use all the same security checks as "loop_set_status()" and 
friends, afaik.

oops, didn't think of that.

There's a bug, too:

+static int loop_set_capacity(struct loop_device *lo, struct block_device *bdev)
+{
+	int err;
+	sector_t sec;
+	loff_t sz;
+
+	err = -ENXIO;
+	if (unlikely(lo->lo_state != Lo_bound))
+		goto out;
+	err = figure_loop_size(lo);
+	if (unlikely(err))
+		goto out;
+	sec = get_capacity(lo->lo_disk);
+	sz = sec << 9;

This can overflow if sector_t is 32-bit.  Fix with:

	sz = (loff_t)sec << 9;

+	mutex_lock(&bdev->bd_mutex);
+	bd_set_size(bdev, sz);
+	mutex_unlock(&bdev->bd_mutex);
+
+ out:
+	return err;
+}

--
To unsubscribe from this list: send the line "unsubscribe linux-api" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html