On Fri, Dec 07, 2018 at 05:10:15PM +0100, Alexander Lochmann wrote: > > inode.i_flags might be altered without proper > synchronisation when the inode belongs to devtmpfs. > blkdev_write_iter() starts writing via __generic_file_write_iter() > which sets S_NOSEC bit without any synchronisation. > The following stacktrace shows how to get there: > 13: entry_SYSENTER_32:460 > 12: do_fast_syscall_32:410 > 11: _static_cpu_has:146 > 10: do_syscall_32_irqs_on:322 > 09: SyS_pwrite64:636 > 08: SYSC_pwrite64:650 > 07: fdput:38 > 06: vfs_write:560 > 05: __vfs_write:512 > 04: new_sync_write:500 > 03: blkdev_write_iter:1977 > 02: __generic_file_write_iter:2897 > 01: file_remove_privs:1818 > 00: inode_has_no_xattr:3163 > If S_NOSEC is *not* set, i_rwsem is acquired around > __generic_file_write_iter(). > + * Ensure excl. access to i_flags in __generic_file_write_iter(). > + * Otherwise, it would race with chmod adding SUID bit. > + */ _What_ SUID bit? We are talking about a write to block device, for fsck sake...
