Andrew Lukoshko
f6916a8ae1
Add the RHEL 211.19.1..211.20.1 backports (1245-1287) from centos-stream-10 and upstream, on top of 211.18.1, plus the dpll RHEL kABI adaptation (1287). RHEL now ships the smb cifs.spnego fix too; the existing ahead-fix 1105 is byte-identical, so RHEL's redundant copy is omitted. Bump to 211.20.1.
60 lines
2.1 KiB
Diff
60 lines
2.1 KiB
Diff
From 51903c441e999d6c7afdf651f0724c26627950d8 Mon Sep 17 00:00:00 2001
|
|
From: Abhi Das <adas@redhat.com>
|
|
Date: Fri, 17 Apr 2026 13:33:50 -0500
|
|
Subject: [PATCH] proc: fix type confusion in pde_set_flags()
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-163346
|
|
CVE: CVE-2025-38653
|
|
|
|
commit 0ce9398aa0830f15f92bbed73853f9861c3e74ff
|
|
Author: wangzijie <wangzijie1@honor.com>
|
|
Date: Thu Sep 4 21:57:15 2025 +0800
|
|
|
|
proc: fix type confusion in pde_set_flags()
|
|
|
|
Commit 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc
|
|
files") missed a key part in the definition of proc_dir_entry:
|
|
|
|
union {
|
|
const struct proc_ops *proc_ops;
|
|
const struct file_operations *proc_dir_ops;
|
|
};
|
|
|
|
So dereference of ->proc_ops assumes it is a proc_ops structure results in
|
|
type confusion and make NULL check for 'proc_ops' not work for proc dir.
|
|
|
|
Add !S_ISDIR(dp->mode) test before calling pde_set_flags() to fix it.
|
|
|
|
Link: https://lkml.kernel.org/r/20250904135715.3972782-1-wangzijie1@honor.com
|
|
Fixes: 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc files")
|
|
Signed-off-by: wangzijie <wangzijie1@honor.com>
|
|
Reported-by: Brad Spengler <spender@grsecurity.net>
|
|
Closes: https://lore.kernel.org/all/20250903065758.3678537-1-wangzijie1@honor.com/
|
|
Cc: Alexey Dobriyan <adobriyan@gmail.com>
|
|
Cc: Al Viro <viro@zeniv.linux.org.uk>
|
|
Cc: Christian Brauner <brauner@kernel.org>
|
|
Cc: Jiri Slaby <jirislaby@kernel.org>
|
|
Cc: Stefano Brivio <sbrivio@redhat.com>
|
|
Cc: <stable@vger.kernel.org>
|
|
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
|
|
Signed-off-by: Abhi Das <adas@redhat.com>
|
|
|
|
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
|
|
index 88423b46e5ce..69150974ad87 100644
|
|
--- a/fs/proc/generic.c
|
|
+++ b/fs/proc/generic.c
|
|
@@ -388,7 +388,8 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
|
|
if (proc_alloc_inum(&dp->low_ino))
|
|
goto out_free_entry;
|
|
|
|
- pde_set_flags(dp);
|
|
+ if (!S_ISDIR(dp->mode))
|
|
+ pde_set_flags(dp);
|
|
|
|
write_lock(&proc_subdir_lock);
|
|
dp->parent = dir;
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|