Commit 69baa3a6 authored by Loic Poulain's avatar Loic Poulain Committed by Jens Axboe
Browse files

block: Deny writable memory mapping if block is read-only 



User should not be able to write block device if it is read-only at
block level (e.g force_ro attribute). This is ensured in the regular
fops write operation (blkdev_write_iter) but not when writing via
user mapping (mmap), allowing user to actually write a read-only
block device via a PROT_WRITE mapping.

Example: This can lead to integrity issue of eMMC boot partition
(e.g mmcblk0boot0) which is read-only by default.

To fix this issue, simply deny shared writable mapping if the block
is readonly.

Note: Block remains writable if switch to read-only is performed
after the initial mapping, but this is expected behavior according
to commit a32e236e ("Partially revert "block: fail op_is_write()
requests to read-only partitions"")'.

Signed-off-by: default avatarLoic Poulain <loic.poulain@linaro.org>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20230510074223.991297-1-loic.poulain@linaro.org


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent c99bff34

block/fops.c

+11 −1
Original line number Diff line number Diff line
@@ -678,6 +678,16 @@ static long blkdev_fallocate(struct file *file, int mode, loff_t start, 
	return error;

}



static int blkdev_mmap(struct file *file, struct vm_area_struct *vma)

{

	struct inode *bd_inode = bdev_file_inode(file);



	if (bdev_read_only(I_BDEV(bd_inode)))

		return generic_file_readonly_mmap(file, vma);



	return generic_file_mmap(file, vma);

}



const struct file_operations def_blk_fops = {

	.open		= blkdev_open,

	.release	= blkdev_close,
@@ -685,7 +695,7 @@ const struct file_operations def_blk_fops = { 
	.read_iter	= blkdev_read_iter,

	.write_iter	= blkdev_write_iter,

	.iopoll		= iocb_bio_iopoll,

	.mmap		= generic_file_mmap,

	.mmap		= blkdev_mmap,

	.fsync		= blkdev_fsync,

	.unlocked_ioctl	= blkdev_ioctl,

#ifdef CONFIG_COMPAT