http://bugzilla.opensuse.org/show_bug.cgi?id=1012504 http://bugzilla.opensuse.org/show_bug.cgi?id=1012504#c3 Tony Mechelynck changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(antoine.mechelync | |k@gmail.com) | --- Comment #3 from Tony Mechelynck --- Created attachment 704951 --> http://bugzilla.opensuse.org/attachment.cgi?id=704951&action=edit yast2 logs y2logs.tgz obtained by Shift+F8 in YaST2 (y2controlcenter). If it makes any difference, I think it was in the KDE/Qt GUI but it might have been in the Gnome/GTK GUI. N.B. I run "zypper lu && zypper lp" every hour or so when at the computer, and when updates or patches are available I install them (also using zypper) as soon as I see them. I hope the part you need was not pushed into never-never-land by virtue of too many stuff having been logged afterwards. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1012504 http://bugzilla.opensuse.org/show_bug.cgi?id=1012504#c11 Stanislav Brabec changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CONFIRMED |IN_PROGRESS --- Comment #11 from Stanislav Brabec --- Tony Mechelynck: There are two bugs. One in util-linux libmount that appears if two loop devices are initialized with the same file, and -oloop=/dev/loop? is used. Second bug is in kernel, and appears if two loop devices are initialized with the same file with btrfs image, and different subvolumes are mounted per each one. YaST experiences the first bug. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1012504 http://bugzilla.opensuse.org/show_bug.cgi?id=1012504#c13 --- Comment #13 from Stanislav Brabec --- util-linux patch was finished and tested. I just sent fixes to the upstream for review. (I cannot provide link yet, their servers are overloaded and archives of util-linux@vger.kernel.org delayed.) It fixes two issues: - The reported issue with use a different loop device than specified. - Detaching of reused loop device, even it is not marked as autoclean. - It also contains test suite. Mail subjects: [PATCH 0/3] fix side effects of loop reuse [PATCH 1/3] libmount: fix mount -oloop=/dev/loopX regression [PATCH 2/3] libmount: Fix incorrect detach of reused loop device [PATCH 3/3] tests: Introduce libmount/loop I am afraid, that these fixes are not sufficient for complete fix of this bug report. mount will just return error instead of doing ugly things. Before: mount created overlapping loop device without even detecting of the data corruption risk. Now (after the regression fix): mount refuses to create overlapping loop device, and either reuses existing loop device, mounts read-only or returns error, depending on re-usability of the existing loop device. It implies one regression: If both existing loop and the requested mount loop are read-only, it is safe to do create two overlapping loops. But mount does not aware of that fact. There are two possible fixes: - Add a heuristic for detecting of safe conditions for read-only loops overlays, by extension of loopcxt_find_overlap() return codes. (Hopefully it is not part of public API.) I am now checking how complicated it would be. - YaST level: Make simple changes in the code that prevent requesting of overlaying loop devices. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1012504 http://bugzilla.opensuse.org/show_bug.cgi?id=1012504#c15 --- Comment #15 from Stanislav Brabec --- Fixes were accepted by the upstream. I will add these fixes to the next planned online update (update round 5) and provide testing packages soon. [PATCH 0/3] fix side effects of loop reuse http://marc.info/?t=148423245500004&r=1&w=2 [PATCH 1/3] libmount: fix mount -oloop=/dev/loopX regression http://marc.info/?l=util-linux-ng&m=148423526328405&w=2 https://git.kernel.org/cgit/utils/util-linux/util-linux.git/commit/?id=37898... [PATCH 2/3] libmount: Fix incorrect detach of reused loop device http://marc.info/?l=util-linux-ng&m=148423526328404&w=2 https://git.kernel.org/cgit/utils/util-linux/util-linux.git/commit/?id=7b466... [PATCH 3/3] tests: Introduce libmount/loop http://marc.info/?l=util-linux-ng&m=148423240827185&w=2 https://git.kernel.org/cgit/utils/util-linux/util-linux.git/commit/?id=2edb8... Tony Mechelynck: I don't know whether the first loop is R/O or R/W. If it is R/W, then it will keep returning error. It is an unsafe configuration, that can cause data corruption. If it is R/O, then it will return error now, but we can think about a heuristic detecting all-R/O condition. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1012504 http://bugzilla.opensuse.org/show_bug.cgi?id=1012504#c22 --- Comment #22 from Tony Mechelynck --- (In reply to Swamp Workflow Management from comment #20)

openSUSE-SU-2017:0589-1: An update that solves one vulnerability and has 6 fixes is now available.

Category: security (important) Bug References: 1008965,1012504,1012632,1019332,1020077,1020985,1023041 CVE References: CVE-2017-2616 Sources used: openSUSE Leap 42.2 (src): python-libmount-2.28-10.2, util-linux-2.28-10.1, util-linux-systemd-2.28-10.1

IIUC, this fix has been available for some time as patch 6436 on the 42.2 Update-Test repository. python-libmount is not installed here but YaST tells me I could get version 2.28-10.2 from Update-Test (and lower versions from OSS and Update-OSS). The other two are installed with the versions shown. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1012504 http://bugzilla.opensuse.org/show_bug.cgi?id=1012504#c24 --- Comment #24 from Tony Mechelynck --- (In reply to Stanislav Brabec from comment #23)

util-linux is inherited from SLE 12 SPx to Leap 42.x. Not sure how it goes in Testing repository. (SLE release process requires longer time, as all packages has to pass tests on all platforms.)

The changes references this bug, but in fact I am not sure, whether it is already fixed.

I suppose that it fixes at least part of the bug.

There is still a regression (see comment 13; well, not exactly regression, it just still does not allow some strange things that can be safely allowed). And I am not sure, whether Repository Management worked in a safe way. (If it did not, change in YaST will be required.)

In the meantime, see the workaround described under "WORKS" in comment #0.

When time permits, I can check possibility to allow two conflicting read only loop devices without complicating the code.

:-) -- You are receiving this mail because: You are on the CC list for the bug.