Commit 895b4c0c authored by Wei Yang's avatar Wei Yang Committed by Andrew Morton
Browse files

fs/proc: fix uaf in proc_readdir_de() 

Pde is erased from subdir rbtree through rb_erase(), but not set the node
to EMPTY, which may result in uaf access.  We should use RB_CLEAR_NODE()
set the erased node to EMPTY, then pde_subdir_next() will return NULL to
avoid uaf access.

We found an uaf issue while using stress-ng testing, need to run testcase
getdent and tun in the same time.  The steps of the issue is as follows:

1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current
   pde is tun3;

2) in the [time windows] unregister netdevice tun3 and tun2, and erase
   them from rbtree.  erase tun3 first, and then erase tun2.  the
   pde(tun2) will be released to slab;

3) continue to getdent process, then pde_subdir_next() will return
   pde(tun2) which is released, it will case uaf access.

CPU 0                                      |    CPU 1
-------------------------------------------------------------------------
traverse dir /proc/pid/net/dev_snmp6/      |   unregister_netdevice(tun->dev)   //tun3 tun2
sys_getdents64()                           |
  iterate_dir()                            |
    proc_readdir()                         |
      proc_readdir_de()                    |     snmp6_unregister_dev()
        pde_get(de);                       |       proc_remove()
        read_unlock(&proc_subdir_lock);    |         remove_proc_subtree()
                                           |           write_lock(&proc_subdir_lock);
        [time window]                      |           rb_erase(&root->subdir_node, &parent->subdir);
                                           |           write_unlock(&proc_subdir_lock);
        read_lock(&proc_subdir_lock);      |
        next = pde_subdir_next(de);        |
        pde_put(de);                       |
        de = next;    //UAF                |

rbtree of dev_snmp6
                        |
                    pde(tun3)
                     /    \
                  NULL  pde(tun2)

Link: https://lkml.kernel.org/r/20251025024233.158363-1-albin_yang@163.com


Signed-off-by: default avatarWei Yang <albinwyang@tencent.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: wangzijie <wangzijie1@honor.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent fa5a0617

fs/proc/generic.c

+9 −3
Original line number Diff line number Diff line
@@ -698,6 +698,12 @@ void pde_put(struct proc_dir_entry *pde) 
	}

}



static void pde_erase(struct proc_dir_entry *pde, struct proc_dir_entry *parent)

{

	rb_erase(&pde->subdir_node, &parent->subdir);

	RB_CLEAR_NODE(&pde->subdir_node);

}



/*

 * Remove a /proc entry and free it if it's not currently in use.

 */
@@ -720,7 +726,7 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent) 
			WARN(1, "removing permanent /proc entry '%s'", de->name);

			de = NULL;

		} else {

			rb_erase(&de->subdir_node, &parent->subdir);

			pde_erase(de, parent);

			if (S_ISDIR(de->mode))

				parent->nlink--;

		}
@@ -764,7 +770,7 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) 
			root->parent->name, root->name);

		return -EINVAL;

	}

	rb_erase(&root->subdir_node, &parent->subdir);

	pde_erase(root, parent);



	de = root;

	while (1) {
@@ -776,7 +782,7 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) 
					next->parent->name, next->name);

				return -EINVAL;

			}

			rb_erase(&next->subdir_node, &de->subdir);

			pde_erase(next, de);

			de = next;

			continue;

		}