Files
twx-linux/include/linux
Ye Bin 63b53198af proc: fix UAF in proc_get_inode()
commit 654b33ada4 upstream.

Fix race between rmmod and /proc/XXX's inode instantiation.

The bug is that pde->proc_ops don't belong to /proc, it belongs to a
module, therefore dereferencing it after /proc entry has been registered
is a bug unless use_pde/unuse_pde() pair has been used.

use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops
never changes so information necessary for inode instantiation can be
saved _before_ proc_register() in PDE itself and used later, avoiding
pde->proc_ops->...  dereference.

      rmmod                         lookup
sys_delete_module
                         proc_lookup_de
			   pde_get(de);
			   proc_get_inode(dir->i_sb, de);
  mod->exit()
    proc_remove
      remove_proc_subtree
       proc_entry_rundown(de);
  free_module(mod);

                               if (S_ISREG(inode->i_mode))
	                         if (de->proc_ops->proc_read_iter)
                           --> As module is already freed, will trigger UAF

BUG: unable to handle page fault for address: fffffbfff80a702b
PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:proc_get_inode+0x302/0x6e0
RSP: 0018:ffff88811c837998 EFLAGS: 00010a06
RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007
RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158
RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20
R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0
R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001
FS:  00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 proc_lookup_de+0x11f/0x2e0
 __lookup_slow+0x188/0x350
 walk_component+0x2ab/0x4f0
 path_lookupat+0x120/0x660
 filename_lookup+0x1ce/0x560
 vfs_statx+0xac/0x150
 __do_sys_newstat+0x96/0x110
 do_syscall_64+0x5f/0x170
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

[adobriyan@gmail.com: don't do 2 atomic ops on the common path]
Link: https://lkml.kernel.org/r/3d25ded0-1739-447e-812b-e34da7990dcf@p183
Fixes: 778f3dd5a1 ("Fix procfs compat_ioctl regression")
Signed-off-by: Ye Bin <yebin10@huawei.com>
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: David S. Miller <davem@davemloft.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-03-28 21:59:55 +01:00
..
2022-01-22 08:33:34 +02:00
2021-05-06 19:24:11 -07:00
2020-05-24 20:48:11 +02:00
2023-01-19 14:46:25 +01:00
2024-10-04 16:29:59 +02:00
2024-06-12 11:11:38 +02:00
2021-02-26 09:41:03 -08:00
2023-01-13 11:48:15 +01:00
2024-07-05 09:34:04 +02:00
2023-05-25 09:26:19 +02:00
2023-04-17 18:01:23 +02:00
2023-01-19 16:07:40 +01:00
2020-03-09 11:12:19 +01:00
2023-03-06 15:49:07 -06:00
2024-03-26 18:20:13 -04:00
2021-08-26 15:32:28 -04:00
2024-12-14 19:59:58 +01:00
2024-08-29 17:33:31 +02:00
2021-07-27 11:00:36 +02:00
2023-03-19 10:02:04 -07:00
2020-03-06 11:06:15 +01:00
2023-06-13 16:49:23 +02:00
2022-01-20 08:52:54 +02:00
2021-07-27 20:11:45 +01:00
2021-07-27 20:11:44 +01:00
2025-02-08 09:51:56 +01:00
2023-05-01 17:50:18 -07:00
2020-07-24 17:12:41 -07:00
2022-02-28 23:26:27 -08:00
2022-06-27 06:29:12 -06:00
2022-09-26 13:31:20 +02:00
2018-06-22 13:43:27 +09:00
2022-07-17 17:31:38 -07:00
2021-02-26 09:41:03 -08:00
2024-06-16 13:47:41 +02:00
2024-06-12 11:12:52 +02:00
2022-01-27 13:53:26 +00:00
2023-08-18 10:18:59 -07:00
2022-06-19 10:38:26 +01:00
2022-07-27 14:04:52 +02:00
2022-08-02 12:34:04 -04:00
2021-07-01 11:06:05 -07:00
2023-06-20 20:17:10 -07:00
2025-02-08 09:52:02 +01:00
2025-01-09 13:31:41 +01:00
2022-09-26 19:46:27 -07:00
2021-09-17 13:52:17 +01:00
2023-06-23 16:59:30 -07:00
2021-09-27 17:00:21 +02:00
2022-02-09 08:04:44 +01:00
2023-06-05 09:36:39 +02:00
2023-07-18 10:07:47 +02:00
2025-02-08 09:52:38 +01:00
2022-12-20 03:13:45 +01:00
2023-08-12 09:18:47 -07:00
2024-06-12 11:11:56 +02:00
2025-03-28 21:59:55 +01:00
2025-01-23 17:21:12 +01:00
2018-07-20 01:11:45 +02:00
2023-10-06 11:01:23 +02:00
2023-10-06 11:01:23 +02:00
2023-05-23 12:55:12 -07:00
2024-05-17 12:01:59 +02:00
2022-03-08 14:33:36 -06:00
2023-07-15 11:34:49 -07:00
2025-01-09 13:31:41 +01:00
2025-02-01 18:37:51 +01:00
2023-01-19 15:01:19 +01:00
2023-05-18 19:52:31 -07:00
2020-12-10 16:17:15 +01:00
2025-02-27 04:10:50 -08:00
2024-08-29 17:33:23 +02:00
2023-11-28 17:19:38 +00:00
2022-05-08 01:33:08 -07:00
2022-09-07 12:42:25 +01:00
2023-08-21 13:37:26 -07:00
2022-09-29 15:20:29 +02:00
2022-04-11 19:18:27 -06:00
2024-10-17 15:24:23 +02:00
2020-10-30 21:57:04 +01:00
2023-08-07 17:55:54 +00:00
2023-03-16 13:08:39 -07:00
2024-11-08 16:28:26 +01:00
2021-10-12 11:41:39 -03:00
2022-08-28 16:52:28 +01:00
2005-04-16 15:20:36 -07:00
2023-03-23 17:25:46 +01:00
2023-08-24 13:27:47 -05:00
2023-04-21 03:02:34 -04:00
2023-08-21 14:52:16 +02:00
2021-10-19 23:44:30 +08:00
2023-08-21 13:37:27 -07:00