Wei Yang
1d1596d68a
fs/proc: fix uaf in proc_readdir_de() ...
[ Upstream commit 895b4c0c79b092d732544011c3cecaf7322c36a1 ]
Pde is erased from subdir rbtree through rb_erase(), but not set the node
to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE()
set the erased node to EMPTY, then pde_subdir_next() will return NULL to
avoid uaf access.
We found an uaf issue while using stress-ng testing, need to run testcase
getdent and tun in the same time. The steps of the issue is as follows:
1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current
pde is tun3;
2) in the [time windows] unregister netdevice tun3 and tun2, and erase
them from rbtree. erase tun3 first, and then erase tun2. the
pde(tun2) will be released to slab;
3) continue to getdent process, then pde_subdir_next() will return
pde(tun2) which is released, it will case uaf access.
CPU 0 | CPU 1
-------------------------------------------------------------------------
traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2
sys_getdents64() |
iterate_dir() |
proc_readdir() |
proc_readdir_de() | snmp6_unregister_dev()
pde_get(de); | proc_remove()
read_unlock(&proc_subdir_lock); | remove_proc_subtree()
| write_lock(&proc_subdir_lock);
[time window] | rb_erase(&root->subdir_node, &parent->subdir);
| write_unlock(&proc_subdir_lock);
read_lock(&proc_subdir_lock); |
next = pde_subdir_next(de); |
pde_put(de); |
de = next; //UAF |
rbtree of dev_snmp6
|
pde(tun3)
/ \
NULL pde(tun2)
Link: https://lkml.kernel.org/r/20251025024233.158363-1-albin_yang@163.com
Signed-off-by: Wei Yang <albinwyang@tencent.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: wangzijie <wangzijie1@honor.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-12-03 12:45:21 +01:00
9p: sysfs_init: don't hardcode error to ENOMEM
2025-12-03 12:45:14 +01:00
affs: don't write overlarge OFS data block size fields
2025-04-10 14:29:42 +02:00
afs: Fix directory format encoding struct
2025-03-13 12:42:52 +01:00
autofs: fix memory leak of waitqueues in autofs_catatonic_mode
2023-09-23 11:00:02 +02:00
btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
2025-12-03 12:45:04 +01:00
cachefiles: fix memory leak in cachefiles_add_cache()
2024-03-06 14:36:10 +00:00
ceph: add checking of wait_for_completion_killable() return value
2025-12-03 12:45:15 +01:00
cifs: fix integer overflow in match_server()
2025-09-09 18:44:02 +02:00
coda: Avoid partial allocation of sig_inputArgs
2023-03-11 16:43:56 +01:00
configfs: Do not override creating attribute file failure in populate_attrs()
2025-06-27 11:02:50 +01:00
cramfs: Verify inode mode when loading from disk
2025-10-29 13:59:55 +01:00
new helper: lookup_positive_unlocked()
2023-09-23 10:59:40 +02:00
dlm: check for defined force value in dlm_lockspace_release
2025-10-29 13:59:58 +01:00
ecryptfs: Fix buffer size for tag 66 packet
2024-06-16 13:28:32 +02:00
efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
2025-09-04 14:05:55 +02:00
erofs: fix incorrect symlink detection in fast symlink
2025-01-09 13:23:27 +01:00
ext2: fix datatype of block number in ext2_xattr_set2()
2023-09-23 11:00:04 +02:00
ext4: detect invalid INLINE_DATA + EXTENTS flag combination
2025-10-29 14:00:01 +01:00
f2fs: fix to avoid out-of-boundary access in dnode page
2025-08-28 16:21:35 +02:00
fat: fix uninitialized variable
2024-11-08 16:20:47 +01:00
fuse: prevent overflow in copy_file_range return value
2025-10-02 13:34:28 +02:00
gfs2: move msleep to sleepable context
2025-06-27 11:02:50 +01:00
hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
2025-10-29 13:59:58 +01:00
hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
2025-10-29 13:59:58 +01:00
fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
2025-12-03 12:45:14 +01:00
mm/hugetlb: fix folio is still mapped when deleted
2025-10-02 13:34:35 +02:00
iomap: Set all uptodate bits for an Uptodate page
2024-03-01 13:13:35 +01:00
isofs: Verify inode mode when loading from disk
2025-08-28 16:21:15 +02:00
jbd2: ensure that all ongoing I/O complete before freeing blocks
2025-10-29 14:00:01 +01:00
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
2025-06-27 11:02:56 +01:00
jfs: fix uninitialized waitqueue in transaction manager
2025-12-03 12:45:13 +01:00
fs/kernfs/dir: obey S_ISGID
2024-02-23 08:25:03 +01:00
fs: lockd: avoid possible wrong NULL parameter
2023-09-23 10:59:48 +02:00
minixfs: Verify inode mode when loading from disk
2025-10-29 13:59:55 +01:00
NFS4: Fix state renewals missing after boot
2025-12-03 12:45:16 +01:00
NFSD: Fix last write offset handling in layoutcommit
2025-10-29 14:00:01 +01:00
nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
2025-10-02 13:34:31 +02:00
fs/nls: make load_nls() take a const parameter
2023-09-23 10:59:38 +02:00
fanotify: disallow mount/sb marks on kernel internal pseudo fs
2023-07-27 08:37:26 +02:00
ntfs: check overflow when iterating ATTR_RECORDs
2022-11-25 17:42:22 +01:00
ocfs2: clear extent cache after moving/defragmenting extents
2025-10-29 13:59:59 +01:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
openpromfs: finish conversion to the new mount API
2024-06-16 13:28:32 +02:00
orangefs: fix xattr related buffer overflow...
2025-12-03 12:45:14 +01:00
ovl: Check for NULL d_inode() in ovl_dentry_upper()
2025-07-17 18:24:51 +02:00
fs/proc: fix uaf in proc_readdir_de()
2025-12-03 12:45:21 +01:00
pstore/ram: Fix crash when setting number of cpus to an odd number
2024-02-23 08:24:55 +01:00
quota: flush quota_release_work upon quota writeback
2024-12-14 19:44:42 +01:00
reiserfs: Check the return value from __getblk()
2023-09-23 10:59:40 +02:00
Squashfs: reject negative file sizes in squashfs_read_inode()
2025-10-29 13:59:55 +01:00
fs: sysfs: Fix reference leak in sysfs_break_active_protection()
2024-05-02 16:18:32 +02:00
sysv: don't call sb_bread() with pointers_lock held
2024-04-13 12:51:38 +02:00
tracefs: Add missing lockdown check to tracefs_create_dir()
2023-09-23 11:00:06 +02:00
ubifs: skip dumping tnc tree when zroot is null
2025-03-13 12:42:59 +01:00
fs: udf: fix OOB read in lengthAllocDescs handling
2025-10-29 13:59:54 +01:00
Revert "unicode: Don't special case ignorable code points"
2024-12-14 19:44:55 +01:00
fsverity: skip PKCS#7 parser when keyring is empty
2023-09-23 10:59:55 +02:00
xfs: don't drop errno values when we fail to ficlone the entire range
2024-12-19 18:05:03 +01:00
fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
2024-04-13 12:51:29 +02:00
attr: block mode changes of symlinks
2023-09-23 11:00:06 +02:00
binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf
2023-01-18 11:41:46 +01:00
fs: binfmt_elf_efpic: don't use missing interpreter's properties
2024-09-04 13:14:54 +02:00
binfmt_flat: Fix integer overflow bug on 32 bit systems
2025-03-13 12:43:07 +01:00
binfmt_misc: cleanup on filesystem umount
2024-09-04 13:14:53 +02:00
block: Don't invalidate pagecache for invalid falloc modes
2024-01-08 11:29:48 +01:00
fs/buffer: fix use-after-free when call bh_read() helper
2025-08-28 16:21:32 +02:00
chardev: fix error handling in cdev_device_add()
2023-01-18 11:41:25 +01:00
lsm: new security_file_ioctl_compat() hook
2024-02-23 08:25:15 +01:00
coredump: hand a pidfd to the usermode coredump helper
2025-06-04 14:32:36 +02:00
vfs: Don't leak disconnected dentries on umount
2025-10-29 14:00:01 +01:00
eventfd: prevent underflow for eventfd semaphores
2023-09-23 10:59:40 +02:00
epoll: Add synchronous wakeup support for ep_poll_callback
2025-01-09 13:23:32 +01:00
exec: Fix incorrect type for ret
2025-10-29 13:59:57 +01:00
fs: Fix file_set_fowner LSM hook inconsistencies
2024-11-08 16:20:34 +01:00
do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
2024-03-26 18:22:13 -04:00
alloc_fdtable(): change calling conventions.
2025-08-28 16:21:37 +02:00
fs/filesystems: Fix potential unsigned integer underflow in fs_name()
2025-06-27 11:02:50 +01:00
writeback: fix call of incorrect macro
2023-05-17 11:35:58 +02:00
fs: avoid empty option when generating legacy mount string
2023-07-27 08:37:25 +02:00
vfs: fix race between evice_inodes() and find_inode()&iput()
2024-11-08 16:20:34 +01:00
fs: Establish locking order for unrelated directories
2023-07-27 08:37:26 +02:00
io_uring: fail NOP if non-zero op flags is passed in
2024-06-16 13:28:48 +02:00
nfs: add missing selections of CONFIG_CRC32
2025-05-02 07:39:20 +02:00
libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
2023-01-18 11:40:55 +01:00
filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64
2024-09-04 13:15:02 +02:00
mbcache: Avoid nesting of cache->c_list_lock under bit locks
2023-01-18 11:41:59 +01:00
fuse: don't truncate cached, mutated symlink
2025-04-10 14:29:36 +02:00
fs: Add 'initramfs_options' to set initramfs mount options
2025-10-29 13:59:55 +01:00
allow finish_no_open(file, ERR_PTR(-E...))
2025-12-03 12:45:12 +01:00
pnode: terminate at peers of source
2023-01-18 11:41:44 +01:00
fs/select: rework stack allocation hack for clang
2024-03-26 18:22:13 -04:00
io_uring: disable polling pollfree files
2022-09-05 10:27:47 +02:00
Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
2022-10-17 17:24:32 +02:00
statfs: enforce statfs[64] structure initialization
2023-05-30 12:44:07 +01:00
fs: explicitly unregister per-superblock BDIs
2024-11-08 16:20:26 +01:00
ovl: skip overlayfs superblocks at global sync
2023-12-08 08:44:27 +01:00
userfaultfd: open userfaultfds with O_RDONLY
2022-10-26 13:22:21 +02:00
fs: don't audit the capability check in simple_xattr_list()
2023-01-18 11:40:53 +01:00
1d1596d68a