On Thu, 21 Aug 2025 18:58:06 +0800 wangzijie wangzijie1@honor.com wrote:
To avoid potential UAF issues during module removal races, we use pde_set_flags() to save proc_ops flags in PDE itself before proc_register(), and then use pde_has_proc_*() helpers instead of directly dereferencing pde->proc_ops->*.
However, the pde_set_flags() call was missing when creating net related proc files. This omission caused incorrect behavior which FMODE_LSEEK was being cleared inappropriately in proc_reg_open() for net proc files. Lars reported it in this link[1].
Fix this by ensuring pde_set_flags() is called when register proc entry, and add NULL check for proc_ops in pde_set_flags().
Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al") Cc: stable@vger.kernel.org Reported-by: Lars Wendler polynomial-c@gmx.de Signed-off-by: wangzijie wangzijie1@honor.com
Tested-by: Stefano Brivio sbrivio@redhat.com
For the records, see also my report and obsolete patch at:
https://lore.kernel.org/linux-fsdevel/20250822172335.3187858-1-sbrivio@redha...