Skip to content

Commit ab79caa

Browse files
committed
proc: fix UAF in proc_get_inode()
jira LE-3460 cve CVE-2025-21999 Rebuild_History Non-Buildable kernel-6.12.0-55.18.1.el10_0 commit-author Ye Bin <[email protected]> commit 654b33a Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc entry has been registered is a bug unless use_pde/unuse_pde() pair has been used. use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops never changes so information necessary for inode instantiation can be saved _before_ proc_register() in PDE itself and used later, avoiding pde->proc_ops->... dereference. rmmod lookup sys_delete_module proc_lookup_de pde_get(de); proc_get_inode(dir->i_sb, de); mod->exit() proc_remove remove_proc_subtree proc_entry_rundown(de); free_module(mod); if (S_ISREG(inode->i_mode)) if (de->proc_ops->proc_read_iter) --> As module is already freed, will trigger UAF BUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_lookup_de+0x11f/0x2e0 __lookup_slow+0x188/0x350 walk_component+0x2ab/0x4f0 path_lookupat+0x120/0x660 filename_lookup+0x1ce/0x560 vfs_statx+0xac/0x150 __do_sys_newstat+0x96/0x110 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e [[email protected]: don't do 2 atomic ops on the common path] Link: https://lkml.kernel.org/r/3d25ded0-1739-447e-812b-e34da7990dcf@p183 Fixes: 778f3dd ("Fix procfs compat_ioctl regression") Signed-off-by: Ye Bin <[email protected]> Signed-off-by: Alexey Dobriyan <[email protected]> Cc: Al Viro <[email protected]> Cc: David S. Miller <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> (cherry picked from commit 654b33a) Signed-off-by: Jonathan Maple <[email protected]>
1 parent 980ae36 commit ab79caa

File tree

4 files changed

+31
-6
lines changed

4 files changed

+31
-6
lines changed

fs/proc/generic.c

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -557,10 +557,16 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode,
557557
return p;
558558
}
559559

560-
static inline void pde_set_flags(struct proc_dir_entry *pde)
560+
static void pde_set_flags(struct proc_dir_entry *pde)
561561
{
562562
if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
563563
pde->flags |= PROC_ENTRY_PERMANENT;
564+
if (pde->proc_ops->proc_read_iter)
565+
pde->flags |= PROC_ENTRY_proc_read_iter;
566+
#ifdef CONFIG_COMPAT
567+
if (pde->proc_ops->proc_compat_ioctl)
568+
pde->flags |= PROC_ENTRY_proc_compat_ioctl;
569+
#endif
564570
}
565571

566572
struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
@@ -624,6 +630,7 @@ struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode,
624630
p->proc_ops = &proc_seq_ops;
625631
p->seq_ops = ops;
626632
p->state_size = state_size;
633+
pde_set_flags(p);
627634
return proc_register(parent, p);
628635
}
629636
EXPORT_SYMBOL(proc_create_seq_private);
@@ -654,6 +661,7 @@ struct proc_dir_entry *proc_create_single_data(const char *name, umode_t mode,
654661
return NULL;
655662
p->proc_ops = &proc_single_ops;
656663
p->single_show = show;
664+
pde_set_flags(p);
657665
return proc_register(parent, p);
658666
}
659667
EXPORT_SYMBOL(proc_create_single_data);

fs/proc/inode.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -656,13 +656,13 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
656656

657657
if (S_ISREG(inode->i_mode)) {
658658
inode->i_op = de->proc_iops;
659-
if (de->proc_ops->proc_read_iter)
659+
if (pde_has_proc_read_iter(de))
660660
inode->i_fop = &proc_iter_file_ops;
661661
else
662662
inode->i_fop = &proc_reg_file_ops;
663663
#ifdef CONFIG_COMPAT
664-
if (de->proc_ops->proc_compat_ioctl) {
665-
if (de->proc_ops->proc_read_iter)
664+
if (pde_has_proc_compat_ioctl(de)) {
665+
if (pde_has_proc_read_iter(de))
666666
inode->i_fop = &proc_iter_file_ops_compat;
667667
else
668668
inode->i_fop = &proc_reg_file_ops_compat;

fs/proc/internal.h

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,20 @@ static inline void pde_make_permanent(struct proc_dir_entry *pde)
8585
pde->flags |= PROC_ENTRY_PERMANENT;
8686
}
8787

88+
static inline bool pde_has_proc_read_iter(const struct proc_dir_entry *pde)
89+
{
90+
return pde->flags & PROC_ENTRY_proc_read_iter;
91+
}
92+
93+
static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde)
94+
{
95+
#ifdef CONFIG_COMPAT
96+
return pde->flags & PROC_ENTRY_proc_compat_ioctl;
97+
#else
98+
return false;
99+
#endif
100+
}
101+
88102
extern struct kmem_cache *proc_dir_entry_cache;
89103
void pde_free(struct proc_dir_entry *pde);
90104

include/linux/proc_fs.h

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,13 @@ enum {
2020
* If in doubt, ignore this flag.
2121
*/
2222
#ifdef MODULE
23-
PROC_ENTRY_PERMANENT = 0U,
23+
PROC_ENTRY_PERMANENT = 0U,
2424
#else
25-
PROC_ENTRY_PERMANENT = 1U << 0,
25+
PROC_ENTRY_PERMANENT = 1U << 0,
2626
#endif
27+
28+
PROC_ENTRY_proc_read_iter = 1U << 1,
29+
PROC_ENTRY_proc_compat_ioctl = 1U << 2,
2730
};
2831

2932
struct proc_ops {

0 commit comments

Comments
 (0)