+ proc-use-the-same-treatment-to-check-proc_lseek-as-ones-for-proc_read_iter-etal.patch added to mm-new branch

+ proc-use-the-same-treatment-to-check-proc_lseek-as-ones-for-proc_read_iter-etal.patch added to mm-new branch

[Andrew Morton]

The patch titled
     Subject: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al.
has been added to the -mm mm-new branch.  Its filename is
     proc-use-the-same-treatment-to-check-proc_lseek-as-ones-for-proc_read_iter-etal.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/proc-use-the-same-treatment-to-check-proc_lseek-as-ones-for-proc_read_iter-etal.patch

This patch will later appear in the mm-new branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Note, mm-new is a provisional staging ground for work-in-progress
patches, and acceptance into mm-new is a notification for others take
notice and to finish up reviews.  Please do not hesitate to respond to
review feedback and post updated versions to replace or incrementally
fixup patches in mm-new.

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days

------------------------------------------------------
From: wangzijie <wangzijie1@honor.com>
Subject: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al.
Date: Sat, 7 Jun 2025 10:13:53 +0800

Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. 
It's a gap in proc_reg_open() after commit 654b33ada4ab("proc: fix UAF in
proc_get_inode()").  Followed by AI Viro's suggestion, fix it in same
manner.

Link: https://lkml.kernel.org/r/20250607021353.1127963-1-wangzijie1@honor.com
Signed-off-by: wangzijie <wangzijie1@honor.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: "Edgecombe, Rick P" <rick.p.edgecombe@intel.com>
Cc: Kirill A. Shuemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/proc/generic.c       |    2 ++
 fs/proc/inode.c         |    2 +-
 fs/proc/internal.h      |    5 +++++
 include/linux/proc_fs.h |    1 +
 4 files changed, 9 insertions(+), 1 deletion(-)

--- a/fs/proc/generic.c~proc-use-the-same-treatment-to-check-proc_lseek-as-ones-for-proc_read_iter-etal
+++ a/fs/proc/generic.c
@@ -569,6 +569,8 @@ static void pde_set_flags(struct proc_di
 	if (pde->proc_ops->proc_compat_ioctl)
 		pde->flags |= PROC_ENTRY_proc_compat_ioctl;
 #endif
+	if (pde->proc_ops->proc_lseek)
+		pde->flags |= PROC_ENTRY_proc_lseek;
 }
 
 struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
--- a/fs/proc/inode.c~proc-use-the-same-treatment-to-check-proc_lseek-as-ones-for-proc_read_iter-etal
+++ a/fs/proc/inode.c
@@ -473,7 +473,7 @@ static int proc_reg_open(struct inode *i
 	typeof_member(struct proc_ops, proc_open) open;
 	struct pde_opener *pdeo;
 
-	if (!pde->proc_ops->proc_lseek)
+	if (!pde_has_proc_lseek(pde))
 		file->f_mode &= ~FMODE_LSEEK;
 
 	if (pde_is_permanent(pde)) {
--- a/fs/proc/internal.h~proc-use-the-same-treatment-to-check-proc_lseek-as-ones-for-proc_read_iter-etal
+++ a/fs/proc/internal.h
@@ -99,6 +99,11 @@ static inline bool pde_has_proc_compat_i
 #endif
 }
 
+static inline bool pde_has_proc_lseek(const struct proc_dir_entry *pde)
+{
+	return pde->flags & PROC_ENTRY_proc_lseek;
+}
+
 extern struct kmem_cache *proc_dir_entry_cache;
 void pde_free(struct proc_dir_entry *pde);
 
--- a/include/linux/proc_fs.h~proc-use-the-same-treatment-to-check-proc_lseek-as-ones-for-proc_read_iter-etal
+++ a/include/linux/proc_fs.h
@@ -27,6 +27,7 @@ enum {
 
 	PROC_ENTRY_proc_read_iter	= 1U << 1,
 	PROC_ENTRY_proc_compat_ioctl	= 1U << 2,
+	PROC_ENTRY_proc_lseek		= 1U << 3,
 };
 
 struct proc_ops {
_

Patches currently in -mm which might be from wangzijie1@honor.com are

proc-use-the-same-treatment-to-check-proc_lseek-as-ones-for-proc_read_iter-etal.patch

Re: + proc-use-the-same-treatment-to-check-proc_lseek-as-ones-for-proc_read_iter-etal.patch added to mm-new branch

[Alexey Dobriyan]

On Sat, Jun 07, 2025 at 03:14:03PM -0700, Andrew Morton wrote:
>      proc-use-the-same-treatment-to-check-proc_lseek-as-ones-for-proc_read_iter-etal.patch

> Link: https://lkml.kernel.org/r/20250607021353.1127963-1-wangzijie1@honor.com
> Signed-off-by: wangzijie <wangzijie1@honor.com>

Fixes: 3f61631d47f1 ("take care to handle NULL ->proc_lseek()")
Reviewed-by: Alexey Dobriyan <adobriyan@gmail.com>