Patch "block: count BLK_OPEN_RESTRICT_WRITES openers" has been added to the 6.8-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    block: count BLK_OPEN_RESTRICT_WRITES openers

to the 6.8-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     block-count-blk_open_restrict_writes-openers.patch
and it can be found in the queue-6.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b7974a95c062fbc3c28a17bf6c0b6d6dfc8b2b61
Author: Christian Brauner <brauner@xxxxxxxxxx>
Date:   Sat Mar 23 17:11:20 2024 +0100

    block: count BLK_OPEN_RESTRICT_WRITES openers
    
    [ Upstream commit 3ff56e285de5a375fbfab3c3f1af81bbd23db36d ]
    
    The original changes in v6.8 do allow for a block device to be reopened
    with BLK_OPEN_RESTRICT_WRITES provided the same holder is used as per
    bdev_may_open(). I think this has a bug.
    
    The first opener @f1 of that block device will set bdev->bd_writers to
    -1. The second opener @f2 using the same holder will pass the check in
    bdev_may_open() that bdev->bd_writers must not be greater than zero.
    
    The first opener @f1 now closes the block device and in bdev_release()
    will end up calling bdev_yield_write_access() which calls
    bdev_writes_blocked() and sets bdev->bd_writers to 0 again.
    
    Now @f2 holds a file to that block device which was opened with
    exclusive write access but bdev->bd_writers has been reset to 0.
    
    So now @f3 comes along and succeeds in opening the block device with
    BLK_OPEN_WRITE betraying @f2's request to have exclusive write access.
    
    This isn't a practical issue yet because afaict there's no codepath
    inside the kernel that reopenes the same block device with
    BLK_OPEN_RESTRICT_WRITES but it will be if there is.
    
    Fix this by counting the number of BLK_OPEN_RESTRICT_WRITES openers. So
    we only allow writes again once all BLK_OPEN_RESTRICT_WRITES openers are
    done.
    
    Link: https://lore.kernel.org/r/20240323-abtauchen-klauen-c2953810082d@brauner
    Fixes: ed5cc702d311 ("block: Add config option to not allow writing to mounted devices")
    Reviewed-by: Jan Kara <jack@xxxxxxx>
    Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/block/bdev.c b/block/bdev.c
index e9f1b12bd75c7..678807bcd0034 100644
--- a/block/bdev.c
+++ b/block/bdev.c
@@ -738,17 +738,17 @@ void blkdev_put_no_open(struct block_device *bdev)
 
 static bool bdev_writes_blocked(struct block_device *bdev)
 {
-	return bdev->bd_writers == -1;
+	return bdev->bd_writers < 0;
 }
 
 static void bdev_block_writes(struct block_device *bdev)
 {
-	bdev->bd_writers = -1;
+	bdev->bd_writers--;
 }
 
 static void bdev_unblock_writes(struct block_device *bdev)
 {
-	bdev->bd_writers = 0;
+	bdev->bd_writers++;
 }
 
 static bool bdev_may_open(struct block_device *bdev, blk_mode_t mode)