Andrew Lukoshko
ca61dd79c6
Add the RHEL 687.11.1..687.12.1 backports (1198-1252) sourced from centos-stream-9 and upstream stable, on top of 687.10.1. Bump to 5.14.0-687.12.1.
141 lines
5.0 KiB
Diff
141 lines
5.0 KiB
Diff
From f71095c72d407f60b21042f2dfbaad3cd1ab093c Mon Sep 17 00:00:00 2001
|
|
From: Abhi Das <adas@redhat.com>
|
|
Date: Fri, 8 May 2026 13:37:49 -0500
|
|
Subject: [PATCH] proc: fix missing pde_set_flags() for net proc files
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-171801
|
|
CVE: CVE-2025-38653
|
|
|
|
commit 2ce3d282bd5050fca8577defeff08ada0d55d062
|
|
Author: wangzijie <wangzijie1@honor.com>
|
|
Date: Mon Aug 18 20:31:02 2025 +0800
|
|
|
|
proc: fix missing pde_set_flags() for net proc files
|
|
|
|
To avoid potential UAF issues during module removal races, we use
|
|
pde_set_flags() to save proc_ops flags in PDE itself before
|
|
proc_register(), and then use pde_has_proc_*() helpers instead of directly
|
|
dereferencing pde->proc_ops->*.
|
|
|
|
However, the pde_set_flags() call was missing when creating net related
|
|
proc files. This omission caused incorrect behavior which FMODE_LSEEK was
|
|
being cleared inappropriately in proc_reg_open() for net proc files. Lars
|
|
reported it in this link[1].
|
|
|
|
Fix this by ensuring pde_set_flags() is called when register proc entry,
|
|
and add NULL check for proc_ops in pde_set_flags().
|
|
|
|
[wangzijie1@honor.com: stash pde->proc_ops in a local const variable, per Christian]
|
|
Link: https://lkml.kernel.org/r/20250821105806.1453833-1-wangzijie1@honor.com
|
|
Link: https://lkml.kernel.org/r/20250818123102.959595-1-wangzijie1@honor.com
|
|
Link: https://lore.kernel.org/all/20250815195616.64497967@chagall.paradoxon.rec/ [1]
|
|
Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al")
|
|
Signed-off-by: wangzijie <wangzijie1@honor.com>
|
|
Reported-by: Lars Wendler <polynomial-c@gmx.de>
|
|
Tested-by: Stefano Brivio <sbrivio@redhat.com>
|
|
Tested-by: Petr Vaněk <pv@excello.cz>
|
|
Tested by: Lars Wendler <polynomial-c@gmx.de>
|
|
Cc: Alexei Starovoitov <ast@kernel.org>
|
|
Cc: Alexey Dobriyan <adobriyan@gmail.com>
|
|
Cc: Al Viro <viro@zeniv.linux.org.uk>
|
|
Cc: "Edgecombe, Rick P" <rick.p.edgecombe@intel.com>
|
|
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Cc: Jiri Slaby <jirislaby@kernel.org>
|
|
Cc: Kirill A. Shutemov <k.shutemov@gmail.com>
|
|
Cc: wangzijie <wangzijie1@honor.com>
|
|
Cc: <stable@vger.kernel.org>
|
|
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
|
|
Signed-off-by: Abhi Das <adas@redhat.com>
|
|
|
|
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
|
|
index 4e0ac5f5d99c..1bfff5c905d8 100644
|
|
--- a/fs/proc/generic.c
|
|
+++ b/fs/proc/generic.c
|
|
@@ -363,6 +363,25 @@ static const struct inode_operations proc_dir_inode_operations = {
|
|
.setattr = proc_notify_change,
|
|
};
|
|
|
|
+static void pde_set_flags(struct proc_dir_entry *pde)
|
|
+{
|
|
+ const struct proc_ops *proc_ops = pde->proc_ops;
|
|
+
|
|
+ if (!proc_ops)
|
|
+ return;
|
|
+
|
|
+ if (proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
|
|
+ pde->flags |= PROC_ENTRY_PERMANENT;
|
|
+ if (proc_ops->proc_read_iter)
|
|
+ pde->flags |= PROC_ENTRY_proc_read_iter;
|
|
+#ifdef CONFIG_COMPAT
|
|
+ if (proc_ops->proc_compat_ioctl)
|
|
+ pde->flags |= PROC_ENTRY_proc_compat_ioctl;
|
|
+#endif
|
|
+ if (proc_ops->proc_lseek)
|
|
+ pde->flags |= PROC_ENTRY_proc_lseek;
|
|
+}
|
|
+
|
|
/* returns the registered entry, or frees dp and returns NULL on failure */
|
|
struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
|
|
struct proc_dir_entry *dp)
|
|
@@ -370,6 +389,8 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
|
|
if (proc_alloc_inum(&dp->low_ino))
|
|
goto out_free_entry;
|
|
|
|
+ pde_set_flags(dp);
|
|
+
|
|
write_lock(&proc_subdir_lock);
|
|
dp->parent = dir;
|
|
if (pde_subdir_insert(dir, dp) == false) {
|
|
@@ -558,20 +579,6 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode,
|
|
return p;
|
|
}
|
|
|
|
-static void pde_set_flags(struct proc_dir_entry *pde)
|
|
-{
|
|
- if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
|
|
- pde->flags |= PROC_ENTRY_PERMANENT;
|
|
- if (pde->proc_ops->proc_read_iter)
|
|
- pde->flags |= PROC_ENTRY_proc_read_iter;
|
|
-#ifdef CONFIG_COMPAT
|
|
- if (pde->proc_ops->proc_compat_ioctl)
|
|
- pde->flags |= PROC_ENTRY_proc_compat_ioctl;
|
|
-#endif
|
|
- if (pde->proc_ops->proc_lseek)
|
|
- pde->flags |= PROC_ENTRY_proc_lseek;
|
|
-}
|
|
-
|
|
struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
|
|
struct proc_dir_entry *parent,
|
|
const struct proc_ops *proc_ops, void *data)
|
|
@@ -582,7 +589,6 @@ struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
|
|
if (!p)
|
|
return NULL;
|
|
p->proc_ops = proc_ops;
|
|
- pde_set_flags(p);
|
|
return proc_register(parent, p);
|
|
}
|
|
EXPORT_SYMBOL(proc_create_data);
|
|
@@ -633,7 +639,6 @@ struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode,
|
|
p->proc_ops = &proc_seq_ops;
|
|
p->seq_ops = ops;
|
|
p->state_size = state_size;
|
|
- pde_set_flags(p);
|
|
return proc_register(parent, p);
|
|
}
|
|
EXPORT_SYMBOL(proc_create_seq_private);
|
|
@@ -664,7 +669,6 @@ struct proc_dir_entry *proc_create_single_data(const char *name, umode_t mode,
|
|
return NULL;
|
|
p->proc_ops = &proc_single_ops;
|
|
p->single_show = show;
|
|
- pde_set_flags(p);
|
|
return proc_register(parent, p);
|
|
}
|
|
EXPORT_SYMBOL(proc_create_single_data);
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|