Skip to content

Commit ff7ec8d

Browse files
wangzijieakpm00
authored andcommitted
proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after commit 654b33a("proc: fix UAF in proc_get_inode()"). Followed by AI Viro's suggestion, fix it in same manner. Link: https://lkml.kernel.org/r/[email protected] Fixes: 3f61631 ("take care to handle NULL ->proc_lseek()") Signed-off-by: wangzijie <[email protected]> Reviewed-by: Alexey Dobriyan <[email protected]> Cc: Alexei Starovoitov <[email protected]> Cc: Al Viro <[email protected]> Cc: "Edgecombe, Rick P" <[email protected]> Cc: Kirill A. Shuemov <[email protected]> Signed-off-by: Andrew Morton <[email protected]>
1 parent a6fde7a commit ff7ec8d

File tree

4 files changed

+9
-1
lines changed

4 files changed

+9
-1
lines changed

fs/proc/generic.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -569,6 +569,8 @@ static void pde_set_flags(struct proc_dir_entry *pde)
569569
if (pde->proc_ops->proc_compat_ioctl)
570570
pde->flags |= PROC_ENTRY_proc_compat_ioctl;
571571
#endif
572+
if (pde->proc_ops->proc_lseek)
573+
pde->flags |= PROC_ENTRY_proc_lseek;
572574
}
573575

574576
struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,

fs/proc/inode.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -473,7 +473,7 @@ static int proc_reg_open(struct inode *inode, struct file *file)
473473
typeof_member(struct proc_ops, proc_open) open;
474474
struct pde_opener *pdeo;
475475

476-
if (!pde->proc_ops->proc_lseek)
476+
if (!pde_has_proc_lseek(pde))
477477
file->f_mode &= ~FMODE_LSEEK;
478478

479479
if (pde_is_permanent(pde)) {

fs/proc/internal.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,11 @@ static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde)
9999
#endif
100100
}
101101

102+
static inline bool pde_has_proc_lseek(const struct proc_dir_entry *pde)
103+
{
104+
return pde->flags & PROC_ENTRY_proc_lseek;
105+
}
106+
102107
extern struct kmem_cache *proc_dir_entry_cache;
103108
void pde_free(struct proc_dir_entry *pde);
104109

include/linux/proc_fs.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ enum {
2727

2828
PROC_ENTRY_proc_read_iter = 1U << 1,
2929
PROC_ENTRY_proc_compat_ioctl = 1U << 2,
30+
PROC_ENTRY_proc_lseek = 1U << 3,
3031
};
3132

3233
struct proc_ops {

0 commit comments

Comments
 (0)