mirror of
https://github.com/veracrypt/VeraCrypt.git
synced 2026-10-22 06:12:35 +00:00
Mounir IDRASSI
b2b28d5793
Unmounting released the loop device and device-mapper devices recorded at mount time, by name. After a dismount that failed partway, for example on a busy auxiliary FUSE mount, these names could be reused by unrelated objects, which the listing then showed as the volume's and a retry, emergency cleanup, filesystem check or auto-dismount released. Without kernel cryptography, the loop device, which carries the decrypted volume, was also released while the filesystem was mounted elsewhere or the device was held open. A failed mount could remove a pre-existing device-mapper device of the same name, and a failed cascade mount could leave its layers and loop device behind. Each destructive step now acts only on a device verified to belong to the volume. A loop device must be bound to the container or volume image (LOOP_GET_STATUS64). Device-mapper devices get the UUID VERACRYPT-<serial>-<name> and are removed by UUID; those of earlier versions, which have none, are verified through their sysfs slaves, and the dismount fails, saying why, if that is not possible. Emergency cleanup is not offered then, as it would hide the volume but leave its devices. While the filesystem is mounted elsewhere, the dismount fails and keeps the volume's devices. With kernel cryptography, the loop device is marked for autoclear as soon as it is attached and verified, so the kernel detaches it once device-mapper releases it; a process holding it open sees only ciphertext and does not fail the dismount. Without kernel cryptography, the dismount also fails while the loop device is held open. Dismount, emergency cleanup, filesystem check and the listing re-read the volume's devices from its auxiliary mount, and the English emergency warning mentions these causes. Add Tests/test_linux_loop_identity.py, covering these cases with and without kernel cryptography, and with --legacy-binary, volumes mounted by an earlier version. All 89 checks pass, as do the 11 added by --legacy-binary 1.26.29; 1.26.29 itself fails 21 of the 89.