
Ye BinandGreg Kroah-Hartman
966f331403
proc: fix UAF in proc_get_inode()
commit 654b33ada4 upstream.
Fix race between rmmod and /proc/XXX's inode instantiation.
The bug is that pde->proc_ops don't belong to /proc, it belongs to a
module, therefore dereferencing it after /proc entry has been registered
is a bug unless use_pde/unuse_pde() pair has been used.
use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops
never changes so information necessary for inode instantiation can be
saved _before_ proc_register() in PDE itself and used later, avoiding
pde->proc_ops->... dereference.
rmmod lookup
sys_delete_module
proc_lookup_de
pde_get(de);
proc_get_inode(dir->i_sb, de);
mod->exit()
proc_remove
remove_proc_subtree
proc_entry_rundown(de);
free_module(mod);
if (S_ISREG(inode->i_mode))
if (de->proc_ops->proc_read_iter)
--> As module is already freed, will trigger UAF
BUG: unable to handle page fault for address: fffffbfff80a702b
PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:proc_get_inode+0x302/0x6e0
RSP: 0018:ffff88811c837998 EFLAGS: 00010a06
RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007
RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158
RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20
R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0
R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001
FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
proc_lookup_de+0x11f/0x2e0
__lookup_slow+0x188/0x350
walk_component+0x2ab/0x4f0
path_lookupat+0x120/0x660
filename_lookup+0x1ce/0x560
vfs_statx+0xac/0x150
__do_sys_newstat+0x96/0x110
do_syscall_64+0x5f/0x170
entry_SYSCALL_64_after_hwframe+0x76/0x7e
[adobriyan@gmail.com: don't do 2 atomic ops on the common path]
Link: https://lkml.kernel.org/r/3d25ded0-1739-447e-812b-e34da7990dcf@p183
Fixes: 778f3dd5a1 ("Fix procfs compat_ioctl regression")
Signed-off-by: Ye Bin <yebin10@huawei.com>
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: David S. Miller <davem@davemloft.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-03-28 21:59:01 +01:00
..
2024-03-15 10:48:13 -04:00
2024-03-06 14:45:14 +00:00
2024-12-19 18:08:54 +01:00
2024-12-14 19:53:12 +01:00
2024-10-22 15:56:42 +02:00
2024-12-14 19:54:27 +01:00
2024-02-23 09:12:40 +01:00
2024-10-22 15:56:51 +02:00
2025-02-21 13:49:03 +01:00
2025-02-21 13:49:32 +01:00
2024-12-14 19:54:38 +01:00
2024-02-23 09:12:49 +01:00
2024-04-03 15:19:33 +02:00
2024-05-17 11:55:54 +02:00
2024-06-21 14:35:51 +02:00
2024-09-12 11:10:21 +02:00
2025-02-21 13:50:04 +01:00
2024-05-17 11:56:10 +02:00
2025-03-07 16:56:42 +01:00
2025-02-21 13:49:27 +01:00
2024-06-12 11:03:08 +02:00
2024-12-14 19:54:53 +01:00
2024-01-31 16:17:00 -08:00
2025-02-21 13:49:29 +01:00
2024-01-25 15:27:42 -08:00
2024-08-29 17:30:15 +02:00
2024-06-12 11:03:08 +02:00
2024-08-14 13:53:01 +02:00
2024-12-14 19:54:08 +01:00
2024-04-27 17:07:17 +02:00
2024-07-18 13:18:34 +02:00
2024-08-29 17:30:17 +02:00
2025-01-17 13:34:43 +01:00
2024-03-06 14:45:19 +00:00
2024-12-14 19:53:57 +01:00
2025-02-21 13:50:04 +01:00
2024-02-23 09:12:51 +01:00
2024-01-25 15:27:37 -08:00
2024-08-14 13:52:57 +02:00
2024-07-05 09:31:59 +02:00
2024-07-18 13:18:31 +02:00
2024-05-17 11:56:20 +02:00
2024-02-23 09:12:51 +01:00
2024-11-08 16:26:43 +01:00
2024-12-19 18:08:58 +01:00
2024-06-12 11:03:34 +02:00
2024-03-15 10:48:21 -04:00
2024-11-08 16:26:39 +01:00
2023-12-13 18:39:03 +01:00
2024-08-29 17:30:14 +02:00
2023-12-20 17:00:20 +01:00
2024-12-14 19:53:51 +01:00
2024-01-01 12:39:08 +00:00
2024-10-17 15:21:32 +02:00
2024-06-12 11:03:21 +02:00
2024-12-14 19:54:55 +01:00
2024-04-10 16:28:32 +02:00
2024-01-01 12:39:05 +00:00
2024-03-26 18:21:02 -04:00
2024-05-17 11:56:16 +02:00
2024-12-14 19:53:57 +01:00
2024-02-16 19:06:24 +01:00
2024-12-14 19:54:49 +01:00
2025-02-21 13:50:04 +01:00
2024-05-02 16:29:29 +02:00
2024-12-14 19:54:37 +01:00
2024-01-05 15:18:38 +01:00
2024-03-26 18:20:23 -04:00
2024-10-17 15:21:10 +02:00
2024-10-17 15:22:03 +02:00
2024-02-23 09:12:51 +01:00
2024-07-05 09:31:47 +02:00
2025-03-28 21:58:53 +01:00
2024-07-25 09:49:20 +02:00
2024-09-08 07:53:10 +02:00
2024-07-11 12:47:14 +02:00
2024-12-14 19:54:26 +01:00
2024-05-17 11:56:07 +02:00
2024-04-03 15:19:42 +02:00
2024-01-10 17:10:33 +01:00
2024-12-14 19:53:17 +01:00
2025-01-23 17:17:15 +01:00
2024-05-17 11:55:52 +02:00
2024-08-03 08:49:29 +02:00
2024-09-08 07:53:09 +02:00
2024-12-27 13:52:59 +01:00
2024-10-17 15:22:04 +02:00
2025-03-28 21:58:48 +01:00
2025-02-21 13:49:03 +01:00
2025-01-09 13:30:02 +01:00
2024-02-23 09:12:38 +01:00
2025-03-28 21:58:53 +01:00
2024-12-27 13:53:00 +01:00
2024-11-08 16:26:42 +01:00
2025-02-21 13:50:09 +01:00
2024-02-05 20:12:49 +00:00
2024-04-17 11:18:28 +02:00
2024-08-29 17:30:17 +02:00
2024-12-14 19:53:19 +01:00
2024-08-03 08:49:05 +02:00
2025-02-21 13:49:20 +01:00
2024-01-01 12:38:52 +00:00
2024-06-27 13:46:22 +02:00
2024-01-01 12:38:58 +00:00
2023-12-13 18:39:17 +01:00
2025-02-21 13:49:39 +01:00
2024-12-14 19:54:46 +01:00
2024-04-03 15:19:51 +02:00
2024-12-14 19:54:00 +01:00
2024-07-11 12:47:16 +02:00
2024-01-31 16:17:01 -08:00
2024-03-01 13:26:36 +01:00
2024-11-08 16:26:47 +01:00
2024-07-25 09:49:07 +02:00
2023-12-20 17:00:26 +01:00
2024-05-17 11:55:51 +02:00
2025-03-07 16:56:47 +01:00
2024-11-22 15:37:34 +01:00
2024-07-18 13:18:31 +02:00
2024-06-27 13:46:23 +02:00
2024-01-05 15:18:40 +01:00
2024-03-26 18:20:52 -04:00
2024-07-11 12:47:04 +02:00
2024-01-05 15:18:29 +01:00
2024-01-10 17:10:27 +01:00
2025-03-07 16:56:36 +01:00
2024-01-25 15:27:51 -08:00
2024-03-06 14:45:08 +00:00
2024-12-14 19:53:34 +01:00
2024-03-06 14:45:17 +00:00
2024-10-17 15:22:19 +02:00
2024-11-14 13:15:10 +01:00
2024-06-12 11:03:17 +02:00
2025-03-28 21:58:52 +01:00
2024-07-05 09:31:50 +02:00
2024-08-03 08:49:05 +02:00
2024-09-04 13:24:59 +02:00
2024-01-10 17:10:32 +01:00
2025-02-21 13:50:11 +01:00
2024-12-14 19:54:28 +01:00
2024-12-27 13:52:52 +01:00
2024-02-23 09:12:51 +01:00
2024-08-03 08:49:41 +02:00
2024-08-29 17:30:18 +02:00
2024-01-31 16:17:09 -08:00
2025-02-21 13:48:56 +01:00
2025-01-23 17:17:12 +01:00
2025-02-21 13:49:55 +01:00
2024-02-23 09:12:51 +01:00
2024-06-12 11:03:21 +02:00
2025-03-28 21:59:01 +01:00
2024-08-14 13:52:50 +02:00
2024-12-14 19:54:28 +01:00
2024-12-19 18:08:53 +01:00
2025-03-07 16:56:51 +01:00
2024-04-13 13:05:25 +02:00
2024-12-14 19:53:19 +01:00
2024-04-13 13:05:07 +02:00
2023-12-13 18:39:17 +01:00
2024-04-03 15:19:35 +02:00
2024-01-31 16:17:02 -08:00
2024-02-23 09:12:51 +01:00
2024-10-17 15:21:10 +02:00
2024-12-14 19:54:31 +01:00
2025-02-21 13:48:54 +01:00
2025-02-01 18:30:05 +01:00
2024-04-10 16:28:34 +02:00
2024-07-11 12:47:16 +02:00
2024-12-14 19:53:19 +01:00
2024-11-01 01:56:02 +01:00
2024-06-12 11:03:32 +02:00
2025-03-07 16:56:37 +01:00
2024-12-14 19:53:57 +01:00
2024-06-16 13:41:42 +02:00
2024-12-14 19:53:33 +01:00
2024-03-01 13:26:36 +01:00
2024-11-22 15:37:35 +01:00
2024-02-23 09:12:51 +01:00
2024-01-10 17:10:27 +01:00
2024-02-23 09:12:51 +01:00
2024-12-19 18:08:59 +01:00
2023-12-13 18:39:08 +01:00
2024-03-01 13:26:32 +01:00
2024-05-17 11:56:24 +02:00
2024-04-27 17:07:10 +02:00
2024-07-05 09:31:59 +02:00
2024-08-11 12:35:51 +02:00
2024-08-03 08:49:34 +02:00
2024-11-14 13:15:16 +01:00
2024-05-17 11:56:13 +02:00
2025-01-02 10:30:54 +01:00
2024-06-27 13:46:17 +02:00
2024-11-01 01:56:02 +01:00
2024-04-17 11:18:23 +02:00
2024-08-29 17:30:56 +02:00
2024-10-17 15:21:46 +02:00
2025-01-17 13:34:49 +01:00
2024-11-14 13:15:18 +01:00
2024-12-14 19:54:14 +01:00
2024-10-17 15:21:12 +02:00
2024-04-03 15:19:46 +02:00
2024-09-18 19:23:04 +02:00
2025-01-02 10:30:48 +01:00
2024-12-27 13:53:01 +01:00
2024-10-17 15:21:26 +02:00