mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-13 14:09:38 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
73d7a69de212aebb59f4ff23aae0422e86c488fe
linux/fs
History
Ye Bin 654b33ada4 proc: fix UAF in proc_get_inode() 
Fix race between rmmod and /proc/XXX's inode instantiation.

The bug is that pde->proc_ops don't belong to /proc, it belongs to a
module, therefore dereferencing it after /proc entry has been registered
is a bug unless use_pde/unuse_pde() pair has been used.

use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops
never changes so information necessary for inode instantiation can be
saved _before_ proc_register() in PDE itself and used later, avoiding
pde->proc_ops->...  dereference.

      rmmod                         lookup
sys_delete_module
                         proc_lookup_de
			   pde_get(de);
			   proc_get_inode(dir->i_sb, de);
  mod->exit()
    proc_remove
      remove_proc_subtree
       proc_entry_rundown(de);
  free_module(mod);

                               if (S_ISREG(inode->i_mode))
	                         if (de->proc_ops->proc_read_iter)
                           --> As module is already freed, will trigger UAF

BUG: unable to handle page fault for address: fffffbfff80a702b
PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:proc_get_inode+0x302/0x6e0
RSP: 0018:ffff88811c837998 EFLAGS: 00010a06
RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007
RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158
RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20
R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0
R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001
FS:  00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 proc_lookup_de+0x11f/0x2e0
 __lookup_slow+0x188/0x350
 walk_component+0x2ab/0x4f0
 path_lookupat+0x120/0x660
 filename_lookup+0x1ce/0x560
 vfs_statx+0xac/0x150
 __do_sys_newstat+0x96/0x110
 do_syscall_64+0x5f/0x170
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

[adobriyan@gmail.com: don't do 2 atomic ops on the common path]
Link: https://lkml.kernel.org/r/3d25ded0-1739-447e-812b-e34da7990dcf@p183
Fixes: 778f3dd5a1 ("Fix procfs compat_ioctl regression")
Signed-off-by: Ye Bin <yebin10@huawei.com>
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: David S. Miller <davem@davemloft.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-03-16 17:40:22 -07:00
..
9p
Merge tag 'pull-revalidate' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2025-01-30 09:13:35 -08:00
adfs
Merge patch series "adfs, affs, befs, hfs, hfsplus: convert to new mount api"
2024-10-08 14:41:53 +02:00
affs
affs: don't write overlarge OFS data block size fields
2025-02-26 15:20:57 +01:00
afs
afs: Give an afs_server object a ref on the afs_cell object it points to
2025-02-21 15:06:29 -08:00
autofs
autofs: fix thinko in validate_dev_ioctl()
2024-10-28 13:16:56 +01:00
bcachefs
bcachefs: copygc now skips non-rw devices
2025-03-06 18:15:01 -05:00
befs
befs: convert befs to use the new mount api
2024-09-18 11:44:43 +02:00
bfs
fs: Convert aops->write_begin to take a folio
2024-08-07 11:33:21 +02:00
btrfs
Merge tag 'for-6.14-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
2025-03-07 11:17:30 -10:00
cachefiles
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
ceph
Merge tag 'ceph-for-6.14-rc1' of https://github.com/ceph/ceph-client
2025-01-31 10:30:34 -08:00
coda
Merge tag 'pull-revalidate' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2025-01-30 09:13:35 -08:00
configfs
configfs: improve item creation performance
2024-11-14 07:45:20 +01:00
cramfs
Merge tag 'vfs-6.11.module.description' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2024-07-15 11:14:59 -07:00
crypto
fscrypt_d_revalidate(): use stable parent inode passed by caller
2025-01-27 19:25:23 -05:00
debugfs
debugfs: Fix the missing initializations in __debugfs_file_get()
2025-01-30 08:22:31 +01:00
devpts
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
dlm
dlm: return -ENOENT if no comm was found
2024-12-19 13:11:24 -06:00
ecryptfs
Pass parent directory inode and expected name to ->d_revalidate()
2025-01-27 19:25:23 -05:00
efivarfs
efivarfs: allow creation of zero length files
2025-02-27 11:27:49 +01:00
efs
efs: fix the efs new mount api implementation
2024-10-15 15:58:36 +02:00
erofs
lockref: remove count argument of lockref_init
2025-02-07 10:27:25 +01:00
exfat
exfat: add a check for invalid data size
2025-03-05 21:53:20 +09:00
exportfs
fs: prepare for "explicit connectable" file handles
2024-11-15 11:34:57 +01:00
ext2
Merge tag 'vfs-6.12.file' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2024-09-16 09:14:02 +02:00
ext4
Merge tag 'pull-revalidate' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2025-01-30 09:13:35 -08:00
f2fs
Merge tag 'f2fs-for-6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs
2025-01-27 20:58:58 -08:00
fat
vfat_revalidate{,_ci}(): use stable parent inode passed by caller
2025-01-27 19:25:24 -05:00
freevxfs
freevxfs: Replace one-element array with flexible array member
2024-11-06 10:42:06 +01:00
fuse
fs/pipe: add simpler helpers for common cases
2025-03-06 18:25:35 -10:00
gfs2
lockref: remove count argument of lockref_init
2025-02-07 10:27:25 +01:00
hfs
Merge tag 'pull-revalidate' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2025-01-30 09:13:35 -08:00
hfsplus
Merge tag 'vfs-6.13.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2024-11-18 09:35:30 -08:00
hostfs
Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2025-01-31 09:33:54 -08:00
hpfs
hpfs: convert hpfs to use the new mount api
2024-10-08 14:41:53 +02:00
hugetlbfs
mm/hugetlb: rename avoid_reserve to cow_from_owner
2025-01-25 20:22:30 -08:00
iomap
iomap: Minor code simplification in iomap_dio_bio_iter()
2025-02-25 11:55:26 +01:00
isofs
isofs: Partially convert zisofs_read_folio to use a folio
2024-12-05 13:52:37 +01:00
jbd2
Merge tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
2025-01-22 19:55:08 -08:00
jffs2
jffs2: Fix rtime decompressor
2024-12-05 12:31:40 +01:00
jfs
Pass parent directory inode and expected name to ->d_revalidate()
2025-01-27 19:25:23 -05:00
kernfs
Merge tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2025-02-01 15:07:56 -08:00
lockd
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
minix
buffer: Convert __block_write_begin() to take a folio
2024-08-07 11:33:36 +02:00
netfs
netfs: Fix setting NETFS_RREQ_ALL_QUEUED to be after all subreqs queued
2025-02-13 16:00:48 +01:00
nfs
Merge tag 'mm-hotfixes-stable-2025-03-08-16-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-03-08 14:34:06 -10:00
nfs_common
nfs: fix incorrect error handling in LOCALIO
2025-01-21 11:34:43 -05:00
nfsd
Merge tag 'nfsd-6.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
2025-02-10 13:11:24 -08:00
nilfs2
nilfs2: fix possible int overflows in nilfs_fiemap()
2025-02-01 03:53:26 -08:00
nls
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
notify
fsnotify: use accessor to set FMODE_NONOTIFY_*
2025-02-07 10:27:26 +01:00
ntfs3
fs/ntfs3: Unify inode corruption marking with _ntfs_bad_inode()
2024-12-30 11:37:40 +03:00
ocfs2
ocfs2: fix incorrect CPU endianness conversion causing mount failure
2025-02-01 03:53:24 -08:00
omfs
fs: Convert aops->write_begin to take a folio
2024-08-07 11:33:21 +02:00
openpromfs
openpromfs: add missing MODULE_DESCRIPTION() macro
2024-06-20 09:46:01 +02:00
orangefs
Merge tag 'for-linus-6.14-ofs4' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux
2025-01-31 09:40:31 -08:00
overlayfs
ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
2025-02-19 18:06:53 +01:00
proc
proc: fix UAF in proc_get_inode()
2025-03-16 17:40:22 -07:00
pstore
Merge tag 'pstore-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
2025-01-20 13:37:14 -08:00
qnx4
qnx4: add MODULE_DESCRIPTION()
2024-05-28 11:52:53 +02:00
qnx6
fs/qnx6: Fix building with GCC 15
2024-12-03 10:40:36 +01:00
quota
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
ramfs
…
romfs
romfs: fix romfs_read_folio()
2024-08-21 22:32:58 +02:00
smb
cifs: fix incorrect validation for num_aces field of smb_acl
2025-03-02 22:50:54 -06:00
squashfs
squashfs: convert squashfs_fill_page() to take a folio
2025-01-24 22:47:22 -08:00
sysfs
sysfs: constify bin_attribute argument of sysfs_bin_attr_simple_read()
2025-01-09 10:43:58 +01:00
sysv
buffer: Convert __block_write_begin() to take a folio
2024-08-07 11:33:36 +02:00
tests
execve: Move KUnit tests to tests/ subdirectory
2024-07-22 18:25:47 -07:00
tracefs
Pass parent directory inode and expected name to ->d_revalidate()
2025-01-27 19:25:23 -05:00
ubifs
ubifs: skip dumping tnc tree when zroot is null
2025-01-18 15:31:35 +01:00
udf
udf: Verify inode link counts before performing rename
2024-11-26 22:54:24 +01:00
ufs
ufs: ufs_sb_private_info: remove unused s_{2,3}apb fields
2024-11-12 19:02:12 -05:00
unicode
Revert "unicode: Don't special case ignorable code points"
2024-12-11 14:11:23 -08:00
vboxsf
vboxsf: fix building with GCC 15
2025-02-07 10:27:24 +01:00
verity
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
xfs
xfs: remove the XBF_STALE check from xfs_buf_rele_cached
2025-02-25 13:05:59 +01:00
zonefs
Merge tag 'zonefs-6.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs
2024-10-02 12:02:15 -07:00
aio.c
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
anon_inodes.c
add a string-to-qstr constructor
2025-01-27 19:25:45 -05:00
attr.c
fs: handle delegated timestamps in setattr_copy_mgtime
2024-10-10 10:20:51 +02:00
backing-file.c
tree-wide: s/revert_creds_light()/revert_creds()/g
2024-12-02 11:25:09 +01:00
bad_inode.c
…
binfmt_elf_fdpic.c
fs: don't block write during exec on pre-content watched files
2024-12-11 17:45:18 +01:00
binfmt_elf.c
fs: don't block write during exec on pre-content watched files
2024-12-11 17:45:18 +01:00
binfmt_flat.c
binfmt_flat: Fix integer overflow bug on 32 bit systems
2025-01-10 08:49:05 -08:00
binfmt_misc.c
Merge tag 'execve-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
2025-01-20 13:27:58 -08:00
binfmt_script.c
fs: binfmt: add missing MODULE_DESCRIPTION() macros
2024-05-28 12:06:51 +02:00
bpf_fs_kfuncs.c
bpf: Add kfunc bpf_get_dentry_xattr() to read xattr from dentry
2024-08-07 11:26:54 -07:00
buffer.c
Merge tag 'mm-stable-2024-11-18-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2024-11-23 09:58:07 -08:00
char_dev.c
fs: Reorganize kerneldoc parameter names
2024-10-22 11:16:57 +02:00
compat_binfmt_elf.c
binfmt_elf: Wire up AT_HWCAP3 at AT_HWCAP4
2024-10-17 18:38:49 +01:00
coredump.c
coredump: Only sort VMAs when core_sort_vma sysctl is set
2025-02-24 10:51:57 -08:00
d_path.c
…
dax.c
fsdax: dax_unshare_iter needs to copy entire blocks
2024-10-07 13:51:47 +02:00
dcache.c
Merge tag 'vfs-6.14-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2025-02-07 09:22:31 -08:00
direct-io.c
fs/direct-io: Remove linux/prefetch.h include
2024-08-19 13:45:02 +02:00
drop_caches.c
sysctl: treewide: constify the ctl_table argument of proc_handlers
2024-07-24 20:59:29 +02:00
eventfd.c
fdget(), trivial conversions
2024-11-03 01:28:06 -05:00
eventpoll.c
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
exec.c
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
fcntl.c
fs: get rid of __FMODE_NONOTIFY kludge
2024-12-09 11:34:29 +01:00
fhandle.c
exportfs: add permission method
2024-12-17 09:16:11 +01:00
file_table.c
fsnotify: disable pre-content and permission events by default
2025-02-07 10:27:27 +01:00
file.c
Merge tag 'vfs-6.14-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2025-01-20 09:40:49 -08:00
filesystems.c
…
fs_context.c
fs: fc_log replace magic number 7 with ARRAY_SIZE()
2024-12-22 11:29:52 +01:00
fs_parser.c
bcachefs: add support for true/false & yes/no in bool-type options
2024-12-21 01:36:17 -05:00
fs_pin.c
…
fs_struct.c
…
fs_types.c
…
fs-writeback.c
Merge patch series "two little writeback cleanups v2"
2024-11-13 14:08:34 +01:00
fsopen.c
fdget(), more trivial conversions
2024-11-03 01:28:06 -05:00
init.c
…
inode.c
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
internal.h
Merge tag 'pull-statx' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2024-11-18 14:54:10 -08:00
ioctl.c
fdget(), trivial conversions
2024-11-03 01:28:06 -05:00
Kconfig
reiserfs: The last commit
2024-10-21 16:29:38 +02:00
Kconfig.binfmt
exec: Add KUnit test for bprm_stack_limits()
2024-06-19 13:13:55 -07:00
kernel_read_file.c
fdget(), trivial conversions
2024-11-03 01:28:06 -05:00
libfs.c
Merge tag 'pull-revalidate' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2025-01-30 09:13:35 -08:00
locks.c
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
Makefile
reiserfs: The last commit
2024-10-21 16:29:38 +02:00
mbcache.c
…
mnt_idmapping.c
Merge tag 'fuse-update-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse
2024-09-24 15:29:42 -07:00
mount.h
fs: cache first and last mount
2025-01-09 16:58:54 +01:00
mpage.c
fs/writeback: convert wbc_account_cgroup_owner to take a folio
2024-10-28 13:26:54 +01:00
namei.c
fuse: don't truncate cached, mutated symlink
2025-02-20 15:48:17 +01:00
namespace.c
fs: fix adding security options to statmount.mnt_opt
2025-02-07 10:27:26 +01:00
nsfs.c
nsfs: remove d_op->d_delete
2025-02-24 11:30:35 +01:00
open.c
fsnotify: disable notification by default for all pseudo files
2025-02-07 10:27:26 +01:00
pidfs.c
pidfs: remove d_op->d_delete
2025-02-24 11:27:02 +01:00
pipe.c
fs/pipe: add simpler helpers for common cases
2025-03-06 18:25:35 -10:00
pnode.c
fs: Fix grammar and spelling in propagate_umount()
2024-12-22 11:29:52 +01:00
pnode.h
…
posix_acl.c
acl: Annotate struct posix_acl with __counted_by()
2024-10-22 11:16:59 +02:00
proc_namespace.c
fs: rename show_mnt_opts -> show_vfsmnt_opts
2024-06-28 14:36:43 +02:00
read_write.c
Merge tag 'pull-fd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2024-11-18 12:24:06 -08:00
readdir.c
introduce "fd_pos" class, convert fdget_pos() users to it.
2024-11-03 01:28:06 -05:00
remap_range.c
convert vfs_dedupe_file_range().
2024-11-03 01:28:07 -05:00
select.c
select: Fix unbalanced user_access_end()
2025-01-13 16:24:16 +01:00
seq_file.c
fs: Reorganize kerneldoc parameter names
2024-10-22 11:16:57 +02:00
signalfd.c
fdget(), trivial conversions
2024-11-03 01:28:06 -05:00
splice.c
fs/pipe: add simpler helpers for common cases
2025-03-06 18:25:35 -10:00
stack.c
…
stat.c
fs/stat.c: avoid harmless garbage value problem in vfs_statx_path()
2025-02-07 10:27:24 +01:00
statfs.c
fdget_raw() users: switch to CLASS(fd_raw)
2024-11-03 01:28:06 -05:00
super.c
lib/list_debug.c: add object information in case of invalid object
2025-01-25 20:22:23 -08:00
sync.c
fdget(), trivial conversions
2024-11-03 01:28:06 -05:00
sysctls.c
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
timerfd.c
Merge tag 'timers-core-2024-11-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2024-11-19 16:35:06 -08:00
userfaultfd.c
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
utimes.c
fdget(), more trivial conversions
2024-11-03 01:28:06 -05:00
xattr.c
xattr: remove redundant check on variable err
2024-11-06 13:00:01 -05:00