All of lore.kernel.org
 help / color / mirror / Atom feed
From: Stefano Brivio <sbrivio@redhat.com>
To: wangzijie <wangzijie1@honor.com>
Cc: <akpm@linux-foundation.org>, <brauner@kernel.org>,
	<viro@zeniv.linux.org.uk>, <adobriyan@gmail.com>,
	<rick.p.edgecombe@intel.com>, <ast@kernel.org>,
	<k.shutemov@gmail.com>, <jirislaby@kernel.org>,
	<linux-fsdevel@vger.kernel.org>, <polynomial-c@gmx.de>,
	<gregkh@linuxfoundation.org>, <stable@vger.kernel.org>,
	<regressions@lists.linux.dev>
Subject: Re: [PATCH v3] proc: fix missing pde_set_flags() for net proc files
Date: Sat, 23 Aug 2025 10:43:15 +0200	[thread overview]
Message-ID: <20250823104315.26060eba@elisabeth> (raw)
In-Reply-To: <20250821105806.1453833-1-wangzijie1@honor.com>

On Thu, 21 Aug 2025 18:58:06 +0800
wangzijie <wangzijie1@honor.com> wrote:

> To avoid potential UAF issues during module removal races, we use pde_set_flags()
> to save proc_ops flags in PDE itself before proc_register(), and then use
> pde_has_proc_*() helpers instead of directly dereferencing pde->proc_ops->*.
> 
> However, the pde_set_flags() call was missing when creating net related proc files.
> This omission caused incorrect behavior which FMODE_LSEEK was being cleared
> inappropriately in proc_reg_open() for net proc files. Lars reported it in this link[1].
> 
> Fix this by ensuring pde_set_flags() is called when register proc entry, and add
> NULL check for proc_ops in pde_set_flags().
> 
> [1]: https://lore.kernel.org/all/20250815195616.64497967@chagall.paradoxon.rec/
> 
> Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al")
> Cc: stable@vger.kernel.org
> Reported-by: Lars Wendler <polynomial-c@gmx.de>
> Signed-off-by: wangzijie <wangzijie1@honor.com>

Tested-by: Stefano Brivio <sbrivio@redhat.com>

For the records, see also my report and obsolete patch at:

  https://lore.kernel.org/linux-fsdevel/20250822172335.3187858-1-sbrivio@redhat.com/

-- 
Stefano


  reply	other threads:[~2025-08-23  8:43 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-08-21 10:58 [PATCH v3] proc: fix missing pde_set_flags() for net proc files wangzijie
2025-08-23  8:43 ` Stefano Brivio [this message]
2025-08-24  9:00 ` Petr Vaněk
2025-08-27  5:32   ` Lars Wendler
2025-09-03  6:57 ` wangzijie

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250823104315.26060eba@elisabeth \
    --to=sbrivio@redhat.com \
    --cc=adobriyan@gmail.com \
    --cc=akpm@linux-foundation.org \
    --cc=ast@kernel.org \
    --cc=brauner@kernel.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=jirislaby@kernel.org \
    --cc=k.shutemov@gmail.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=polynomial-c@gmx.de \
    --cc=regressions@lists.linux.dev \
    --cc=rick.p.edgecombe@intel.com \
    --cc=stable@vger.kernel.org \
    --cc=viro@zeniv.linux.org.uk \
    --cc=wangzijie1@honor.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.