kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/fs/proc
History
Ye Bin ede3e8ac90 proc: fix UAF in proc_get_inode() 
commit 654b33ada4 upstream.

Fix race between rmmod and /proc/XXX's inode instantiation.

The bug is that pde->proc_ops don't belong to /proc, it belongs to a
module, therefore dereferencing it after /proc entry has been registered
is a bug unless use_pde/unuse_pde() pair has been used.

use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops
never changes so information necessary for inode instantiation can be
saved _before_ proc_register() in PDE itself and used later, avoiding
pde->proc_ops->...  dereference.

      rmmod                         lookup
sys_delete_module
                         proc_lookup_de
			   pde_get(de);
			   proc_get_inode(dir->i_sb, de);
  mod->exit()
    proc_remove
      remove_proc_subtree
       proc_entry_rundown(de);
  free_module(mod);

                               if (S_ISREG(inode->i_mode))
	                         if (de->proc_ops->proc_read_iter)
                           --> As module is already freed, will trigger UAF

BUG: unable to handle page fault for address: fffffbfff80a702b
PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:proc_get_inode+0x302/0x6e0
RSP: 0018:ffff88811c837998 EFLAGS: 00010a06
RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007
RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158
RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20
R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0
R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001
FS:  00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 proc_lookup_de+0x11f/0x2e0
 __lookup_slow+0x188/0x350
 walk_component+0x2ab/0x4f0
 path_lookupat+0x120/0x660
 filename_lookup+0x1ce/0x560
 vfs_statx+0xac/0x150
 __do_sys_newstat+0x96/0x110
 do_syscall_64+0x5f/0x170
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

[adobriyan@gmail.com: don't do 2 atomic ops on the common path]
Link: https://lkml.kernel.org/r/3d25ded0-1739-447e-812b-e34da7990dcf@p183
Fixes: 778f3dd5a1 ("Fix procfs compat_ioctl regression")
Signed-off-by: Ye Bin <yebin10@huawei.com>
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: David S. Miller <davem@davemloft.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-03-28 22:03:30 +01:00
..
array.c fs/proc: do_task_stat: Fix ESP not readable during coredump 2025-02-17 10:05:04 +01:00
base.c In the v6.12 scheduler development cycle we had 63 commits from 18 contributors: 2024-09-19 15:55:58 +02:00
bootconfig.c fs/proc: Skip bootloader comment if no embedded kernel parameters 2024-04-09 23:36:18 +09:00
cmdline.c proc: mark /proc/cmdline as permanent 2023-02-02 22:50:02 -08:00
consoles.c proc: Add nbcon support for /proc/consoles 2024-09-04 15:56:33 +02:00
cpuinfo.c x86/aperfmperf: Replace aperfmperf_get_khz() 2022-04-27 20:22:19 +02:00
devices.c proc: mark more files as permanent 2022-10-03 14:21:45 -07:00
fd.c proc: Fix W=1 build kernel-doc warning 2024-10-18 13:02:47 +02:00
fd.h fs: port ->permission() to pass mnt_idmap 2023-01-19 09:24:28 +01:00
generic.c proc: fix UAF in proc_get_inode() 2025-03-28 22:03:30 +01:00
inode.c proc: fix UAF in proc_get_inode() 2025-03-28 22:03:30 +01:00
internal.h proc: fix UAF in proc_get_inode() 2025-03-28 22:03:30 +01:00
interrupts.c proc: introduce proc_create_seq{,_data} 2018-05-16 07:23:35 +02:00
Kconfig crash: split vmcoreinfo exporting code out from crash_core.c 2024-02-23 17:48:22 -08:00
kcore.c fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero 2024-12-09 10:41:07 +01:00
kmsg.c printk changes for 6.1 2022-10-10 11:24:19 -07:00
loadavg.c proc: mark more files as permanent 2022-10-03 14:21:45 -07:00
Makefile kbuild: make -Woverride-init warnings more consistent 2024-03-31 11:32:26 +09:00
meminfo.c mm: zswap: optimize zswap pool size tracking 2024-04-25 20:55:47 -07:00
namespaces.c Merge branch 'work.openat2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-01-29 11:20:24 -08:00
nommu.c fs: create helper file_user_path() for user displayed mapped file path 2023-10-19 11:03:15 +02:00
page.c x86: remove PG_uncached 2024-09-03 21:15:46 -07:00
proc_net.c fs: Add kernel-doc comments to proc_create_net_data_write() 2024-03-26 09:01:18 +01:00
proc_sysctl.c sysctl: avoid spurious permanent empty tables 2024-09-02 10:37:37 +02:00
proc_tty.c proc: delete unused <linux/uaccess.h> includes 2022-07-17 17:31:39 -07:00
root.c procfs: make freeing proc_fs_info rcu-delayed 2024-02-25 02:10:32 -05:00
self.c proc: convert to new timestamp accessors 2023-10-18 14:08:26 +02:00
softirqs.c proc/softirqs: replace seq_printf with seq_put_decimal_ull_width 2024-11-07 07:40:14 -10:00
stat.c proc/stat: remove arch_idle_time() 2023-04-18 16:39:33 -07:00
task_mmu.c fs/proc/task_mmu: fix pagemap flags with PMD THP entries on 32bit 2025-01-09 13:33:53 +01:00
task_nommu.c vfs-6.7.misc 2023-10-30 09:14:19 -10:00
thread_self.c proc: convert to new timestamp accessors 2023-10-18 14:08:26 +02:00
uptime.c proc: mark more files as permanent 2022-10-03 14:21:45 -07:00
util.c fs/proc/util.c: include fs/proc/internal.h for name_to_int() 2019-01-04 13:13:45 -08:00
version.c proc: mark more files as permanent 2022-10-03 14:21:45 -07:00
vmcore.c fs/proc: fix softlockup in __read_vmcore (part 2) 2025-01-23 17:23:01 +01:00