kgess-mirror/debian-linux
1
0
Fork 0
mirror of https://salsa.debian.org/kernel-team/linux.git synced 2026-01-16 23:12:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

proc: fix missing pde_set_flags() for net proc files

Browse source 
Apply patch for a regression in 6.16.1.  This has not yet been applied
upstream but has been tested and looks OK to me.

(cherry picked from commit 8765ecb339)
[Salvatore Bonaccorso: Do not explicitly mention regression from 6.16.1]
(cherry picked from commit 62a4ef2d64)
This commit is contained in:
Salvatore Bonaccorso 2025-08-25 22:41:12 +02:00
parent 317acec3f1
commit bd24651ec0
3 changed files with 110 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
debian/changelog vendored
View file

@ -252,6 +252,7 @@ linux (6.1.148-1) UNRELEASED; urgency=medium
* Delete ABI name suffix and ABI reference
* d/salsa-ci.yml: Ignore pycodestyle error E241
* d/rules.real: Move module installation to the image build rule
* proc: fix missing pde_set_flags() for net proc files
[ Salvatore Bonaccorso ]
* [amd64] udeb: kernel-image: Include SPI drivers

108
debian/patches/bugfix/all/proc-fix-missing-pde_set_flags-for-net-proc-files.patch vendored Normal file
View file

@ -0,0 +1,108 @@
From: wangzijie <wangzijie1@honor.com>
Subject: proc: fix missing pde_set_flags() for net proc files
Date: Thu, 21 Aug 2025 18:58:06 +0800
Origin: https://lore.kernel.org/stable/20250821105806.1453833-1-wangzijie1@honor.com/
To avoid potential UAF issues during module removal races, we use pde_set_flags()
to save proc_ops flags in PDE itself before proc_register(), and then use
pde_has_proc_*() helpers instead of directly dereferencing pde->proc_ops->*.
However, the pde_set_flags() call was missing when creating net related proc files.
This omission caused incorrect behavior which FMODE_LSEEK was being cleared
inappropriately in proc_reg_open() for net proc files. Lars reported it in this link[1].
Fix this by ensuring pde_set_flags() is called when register proc entry, and add
NULL check for proc_ops in pde_set_flags().
[1]: https://lore.kernel.org/all/20250815195616.64497967@chagall.paradoxon.rec/
Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al")
Cc: stable@vger.kernel.org
Reported-by: Lars Wendler <polynomial-c@gmx.de>
Signed-off-by: wangzijie <wangzijie1@honor.com>
---
fs/proc/generic.c | 38 +++++++++++++++++++++-----------------
1 file changed, 21 insertions(+), 17 deletions(-)
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -364,6 +364,25 @@ static const struct inode_operations pro
.setattr = proc_notify_change,
};
+static void pde_set_flags(struct proc_dir_entry *pde)
+{
+ const struct proc_ops *proc_ops = pde->proc_ops;
+
+ if (!proc_ops)
+ return;
+
+ if (proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
+ pde->flags |= PROC_ENTRY_PERMANENT;
+ if (proc_ops->proc_read_iter)
+ pde->flags |= PROC_ENTRY_proc_read_iter;
+#ifdef CONFIG_COMPAT
+ if (proc_ops->proc_compat_ioctl)
+ pde->flags |= PROC_ENTRY_proc_compat_ioctl;
+#endif
+ if (proc_ops->proc_lseek)
+ pde->flags |= PROC_ENTRY_proc_lseek;
+}
+
/* returns the registered entry, or frees dp and returns NULL on failure */
struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
struct proc_dir_entry *dp)
@@ -371,6 +390,8 @@ struct proc_dir_entry *proc_register(str
if (proc_alloc_inum(&dp->low_ino))
goto out_free_entry;
+ pde_set_flags(dp);
+
write_lock(&proc_subdir_lock);
dp->parent = dir;
if (pde_subdir_insert(dir, dp) == false) {
@@ -559,20 +580,6 @@ struct proc_dir_entry *proc_create_reg(c
return p;
}
-static void pde_set_flags(struct proc_dir_entry *pde)
-{
- if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
- pde->flags |= PROC_ENTRY_PERMANENT;
- if (pde->proc_ops->proc_read_iter)
- pde->flags |= PROC_ENTRY_proc_read_iter;
-#ifdef CONFIG_COMPAT
- if (pde->proc_ops->proc_compat_ioctl)
- pde->flags |= PROC_ENTRY_proc_compat_ioctl;
-#endif
- if (pde->proc_ops->proc_lseek)
- pde->flags |= PROC_ENTRY_proc_lseek;
-}
-
struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
struct proc_dir_entry *parent,
const struct proc_ops *proc_ops, void *data)
@@ -583,7 +590,6 @@ struct proc_dir_entry *proc_create_data(
if (!p)
return NULL;
p->proc_ops = proc_ops;
- pde_set_flags(p);
return proc_register(parent, p);
}
EXPORT_SYMBOL(proc_create_data);
@@ -634,7 +640,6 @@ struct proc_dir_entry *proc_create_seq_p
p->proc_ops = &proc_seq_ops;
p->seq_ops = ops;
p->state_size = state_size;
- pde_set_flags(p);
return proc_register(parent, p);
}
EXPORT_SYMBOL(proc_create_seq_private);
@@ -665,7 +670,6 @@ struct proc_dir_entry *proc_create_singl
return NULL;
p->proc_ops = &proc_single_ops;
p->single_show = show;
- pde_set_flags(p);
return proc_register(parent, p);
}
EXPORT_SYMBOL(proc_create_single_data);

1
debian/patches/series vendored
View file

@ -104,6 +104,7 @@ bugfix/all/disable-some-marvell-phys.patch
bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch
bugfix/all/netlink-avoid-infinite-retry-looping-in-netlink_unic.patch
bugfix/all/ext4-don-t-try-to-clear-the-orphan_present-feature-b.patch
bugfix/all/proc-fix-missing-pde_set_flags-for-net-proc-files.patch
# Miscellaneous features