+ proc-avoid-use-after-free-in-proc_reg_open.patch added to mm-nonmm-unstable branch

+ proc-avoid-use-after-free-in-proc_reg_open.patch added to mm-nonmm-unstable branch

[Andrew Morton]

The patch titled
     Subject: proc: avoid use-after-free in proc_reg_open()
has been added to the -mm mm-nonmm-unstable branch.  Its filename is
     proc-avoid-use-after-free-in-proc_reg_open.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/proc-avoid-use-after-free-in-proc_reg_open.patch

This patch will later appear in the mm-nonmm-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days

------------------------------------------------------
From: wangzijie <wangzijie1@honor.com>
Subject: proc: avoid use-after-free in proc_reg_open()
Date: Wed, 28 May 2025 11:47:56 +0800

Like the rmmod scenario mentioned by Ye Bin in proc: fix use-after-free in
proc_get_inode()[1], we should get pde->proc_ops after use_pde for
non-permanent pde to avoid UAF in proc_reg_open().

[1] https://lore.kernel.org/all/20250301034024.277290-1-yebin@huaweicloud.com/

Link: https://lkml.kernel.org/r/20250528034756.4069180-1-wangzijie1@honor.com
Signed-off-by: wangzijie <wangzijie1@honor.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: "Edgecombe, Rick P" <rick.p.edgecombe@intel.com>
Cc: Kirill A. Shuemov <kirill.shutemov@linux.intel.com>
Cc: Ye Bin <yebin10@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/proc/inode.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/fs/proc/inode.c~proc-avoid-use-after-free-in-proc_reg_open
+++ a/fs/proc/inode.c
@@ -473,13 +473,13 @@ static int proc_reg_open(struct inode *i
 	typeof_member(struct proc_ops, proc_open) open;
 	struct pde_opener *pdeo;
 
-	if (!pde->proc_ops->proc_lseek)
-		file->f_mode &= ~FMODE_LSEEK;
-
 	if (pde_is_permanent(pde)) {
 		open = pde->proc_ops->proc_open;
-		if (open)
+		if (open) {
+			if (!pde->proc_ops->proc_lseek)
+				file->f_mode &= ~FMODE_LSEEK;
 			rv = open(inode, file);
+		}
 		return rv;
 	}
 
@@ -506,6 +506,9 @@ static int proc_reg_open(struct inode *i
 		}
 	}
 
+	if (!pde->proc_ops->proc_lseek)
+		file->f_mode &= ~FMODE_LSEEK;
+
 	open = pde->proc_ops->proc_open;
 	if (open)
 		rv = open(inode, file);
_

Patches currently in -mm which might be from wangzijie1@honor.com are

proc-avoid-use-after-free-in-proc_reg_open.patch