Unverified Commit f070c1ba authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15800 proc: fix UAF in proc_get_inode() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yongjian Sun <sunyongjian1@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/M5UH2MRK5ZYIWQSDIK4QYX3H7N75KRKT/ 
 
 
 
Link:https://gitee.com/openeuler/kernel/pulls/15800

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 290fa550 5f8a75b0

fs/proc/generic.c

+9 −1
Original line number Diff line number Diff line
@@ -557,10 +557,16 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode, 
	return p;

}



static inline void pde_set_flags(struct proc_dir_entry *pde)

static void pde_set_flags(struct proc_dir_entry *pde)

{

	if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT)

		pde->flags |= PROC_ENTRY_PERMANENT;

	if (pde->proc_ops->proc_read_iter)

		pde->flags |= PROC_ENTRY_proc_read_iter;

#ifdef CONFIG_COMPAT

	if (pde->proc_ops->proc_compat_ioctl)

		pde->flags |= PROC_ENTRY_proc_compat_ioctl;

#endif

}



struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
@@ -624,6 +630,7 @@ struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode, 
	p->proc_ops = &proc_seq_ops;

	p->seq_ops = ops;

	p->state_size = state_size;

	pde_set_flags(p);

	return proc_register(parent, p);

}

EXPORT_SYMBOL(proc_create_seq_private);
@@ -654,6 +661,7 @@ struct proc_dir_entry *proc_create_single_data(const char *name, umode_t mode, 
		return NULL;

	p->proc_ops = &proc_single_ops;

	p->single_show = show;

	pde_set_flags(p);

	return proc_register(parent, p);

}

EXPORT_SYMBOL(proc_create_single_data);

fs/proc/inode.c

+3 −3
Original line number Diff line number Diff line
@@ -679,13 +679,13 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) 


	if (S_ISREG(inode->i_mode)) {

		inode->i_op = de->proc_iops;

		if (de->proc_ops->proc_read_iter)

		if (pde_has_proc_read_iter(de))

			inode->i_fop = &proc_iter_file_ops;

		else

			inode->i_fop = &proc_reg_file_ops;

#ifdef CONFIG_COMPAT

		if (de->proc_ops->proc_compat_ioctl) {

			if (de->proc_ops->proc_read_iter)

		if (pde_has_proc_compat_ioctl(de)) {

			if (pde_has_proc_read_iter(de))

				inode->i_fop = &proc_iter_file_ops_compat;

			else

				inode->i_fop = &proc_reg_file_ops_compat;

fs/proc/internal.h

+14 −0
Original line number Diff line number Diff line
@@ -84,6 +84,20 @@ static inline void pde_make_permanent(struct proc_dir_entry *pde) 
	pde->flags |= PROC_ENTRY_PERMANENT;

}



static inline bool pde_has_proc_read_iter(const struct proc_dir_entry *pde)

{

	return pde->flags & PROC_ENTRY_proc_read_iter;

}



static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde)

{

#ifdef CONFIG_COMPAT

	return pde->flags & PROC_ENTRY_proc_compat_ioctl;

#else

	return false;

#endif

}



extern struct kmem_cache *proc_dir_entry_cache;

void pde_free(struct proc_dir_entry *pde);

include/linux/proc_fs.h

+5 −2
Original line number Diff line number Diff line
@@ -24,6 +24,9 @@ enum { 
#else

	PROC_ENTRY_PERMANENT		= 1U << 0,

#endif



	PROC_ENTRY_proc_read_iter	= 1U << 1,

	PROC_ENTRY_proc_compat_ioctl	= 1U << 2,

};



struct proc_ops {