mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-11-06 17:39:01 +01:00
proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario.
It's a gap in proc_reg_open() after commit 654b33ada4ab("proc: fix UAF in
proc_get_inode()"). Followed by AI Viro's suggestion, fix it in same
manner.
Link: https://lkml.kernel.org/r/[email protected]
Fixes: 3f61631d47 ("take care to handle NULL ->proc_lseek()")
Signed-off-by: wangzijie <[email protected]>
Reviewed-by: Alexey Dobriyan <[email protected]>
Cc: Alexei Starovoitov <[email protected]>
Cc: Al Viro <[email protected]>
Cc: "Edgecombe, Rick P" <[email protected]>
Cc: Kirill A. Shuemov <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
This commit is contained in:
1 parent
a6fde7add7
commit
ff7ec8dc1b
4 files changed
+9
-1
No files matched your search
@@ -569,6 +569,8 @@ static void pde_set_flags(struct proc_dir_entry *pde)
|
||||
if (pde->proc_ops->proc_compat_ioctl)
|
||||
pde->flags |= PROC_ENTRY_proc_compat_ioctl;
|
||||
#endif
|
||||
if (pde->proc_ops->proc_lseek)
|
||||
pde->flags |= PROC_ENTRY_proc_lseek;
|
||||
}
|
||||
|
||||
struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
|
||||
|
||||
+1
-1
@@ -473,7 +473,7 @@ static int proc_reg_open(struct inode *inode, struct file *file)
|
||||
typeof_member(struct proc_ops, proc_open) open;
|
||||
struct pde_opener *pdeo;
|
||||
|
||||
if (!pde->proc_ops->proc_lseek)
|
||||
if (!pde_has_proc_lseek(pde))
|
||||
file->f_mode &= ~FMODE_LSEEK;
|
||||
|
||||
if (pde_is_permanent(pde)) {
|
||||
|
||||
@@ -99,6 +99,11 @@ static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde)
|
||||
#endif
|
||||
}
|
||||
|
||||
static inline bool pde_has_proc_lseek(const struct proc_dir_entry *pde)
|
||||
{
|
||||
return pde->flags & PROC_ENTRY_proc_lseek;
|
||||
}
|
||||
|
||||
extern struct kmem_cache *proc_dir_entry_cache;
|
||||
void pde_free(struct proc_dir_entry *pde);
|
||||
|
||||
|
||||
@@ -27,6 +27,7 @@ enum {
|
||||
|
||||
PROC_ENTRY_proc_read_iter = 1U << 1,
|
||||
PROC_ENTRY_proc_compat_ioctl = 1U << 2,
|
||||
PROC_ENTRY_proc_lseek = 1U << 3,
|
||||
};
|
||||
|
||||
struct proc_ops {
|
||||
|
||||
Reference in new issue
Block a user