From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 71EB648AE11 for ; Mon, 18 May 2026 16:35:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779122131; cv=none; b=G4QkrdNFEMX9qqWv8IkCtr6oyR+hdy+TegZ7BxXSsBsxpDGefrQilgIeDXwYefmj8yBwLOUTdxLXE4nIS3QqGt1wGVx9LU8yCADv0yMC0UQr0347kT3ZYV16NZEqLx2IFz4tf21PVKuscXLMLhVUBUfC6uhMd2OPeGj/A7Axl9E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779122131; c=relaxed/simple; bh=lADZGL1l+uV+dRUhIFGvk44P/1X//TbM0Q/BhApFkWk=; h=From:Subject:Date:Message-Id:MIME-Version:Content-Type:To:Cc; b=fKVJAgx4Vju+lCudT8gmizIDZehaLcxweDjHKK4x8lv5T42BxtdYQF8JHg5N7I5Tg6jVtcBDcbrP8+9oL7OZ3YD/jNKustIPTWLHBEXrB6CH4Bzkj+NZ9NyjpKhMiWUgK/U8dnZxkdfYIc0lQbNTRF099aSxUb3MvawGIPN0ZcY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=seXqiink; arc=none smtp.client-ip=209.85.128.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="seXqiink" Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-4891b4934ffso1015e9.0 for ; Mon, 18 May 2026 09:35:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1779122126; x=1779726926; darn=vger.kernel.org; h=cc:to:content-transfer-encoding:mime-version:message-id:date :subject:from:from:to:cc:subject:date:message-id:reply-to; bh=n6RI1o8QPT8hiZuDRhk2bWs7AEZtLDRZKqnNbFswNzg=; b=seXqiinkpUmksbB7slzxfwbJTHfuUtmJSJ+WK8sSje+0Y53vgfVPO4ny5z11hEHabh HOGX/piPC074psVJNXl18wAlXSEFk2+AYZ51Lh02aaHZ6latauUCG9SoLEYRiTWaTJZ9 uj+N5tOC4vc7qXP4ABS3RD4NkuN3HxJjVfS45hU5pqfSihPsAH4qBUrSWZla924z+QNN g4FUM+oScM6YGHlI7to/Eli9f6K1HkdKCuEojME2NUI02duaGS1iTPt975jotYzeDi5s QxcPFSW+WVb3T+BCS+v1sOh2VzHw809FwNJnbWTSm5OKLHkJIRMUq1vtiqxQafqli/dz +xsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779122126; x=1779726926; h=cc:to:content-transfer-encoding:mime-version:message-id:date :subject:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=n6RI1o8QPT8hiZuDRhk2bWs7AEZtLDRZKqnNbFswNzg=; b=QLic91GunZthewJmOZPN3D7/oUqGV096tYClfAcNbUaLLlAgmT7AYXraBVC2sS9C1R LVW0IuANNwMjRwEElH8Bb8mMmPq/QRzOscRsl9M54A2VvS798X3Ml07/KUX2RtqZ5dHY j5w1LakGXJTvEYI1bUEykU+wrYkKfMVRwLipD63lha+6avMa5RxC9CUhRIm/0n6CQNoL fpCzWWSlNQkvsSyxLqfJ4ClMBm+qRHdpShPFziZhu7Q3q+G6U3aqtqBwAt80ifRGnqx1 QwVtCdUEdF66uoXx4kru4o7aY0m0CKZYAnhuDnaIutZHl7TukvnQJEGyCbvEoi9QRz+g qAsA== X-Forwarded-Encrypted: i=1; AFNElJ8gMQOlX46PdVZyB8LwyowvA22dtyhvvwbOe2jRQWhVjwy+UxHqJ4u4NAZYto3FfJWOd9Y90Empv0ZDz30=@vger.kernel.org X-Gm-Message-State: AOJu0YzEUE415KX+bwyON7qYB7X92Fu7ZBvlyOPpN9PCNEyhYg31gNBf cTX9/y18ExsSRzbJlbYcWcwjwQF5RrFYXAgL/GFsr6N9JmiVAkoyH9Up7fQK7GRFzQ== X-Gm-Gg: Acq92OGrcXHpjbsdLObOezd4cKS1fVwCpTmhz2k7G8pAArBF8qvT2jb3vOwc4tGKI97 RP0ymNiIpQvnVxVBB6iBj3nsG25Gg20KALmNfgJBtV0V4jm69AeFxjpO+Lfip5bHuCskx1hUn5B Nv2DSlBstdUxZkiX27i4+iINs2rBW/O7TRZhc1f5C9Q3k3qxGigmF71iVetoPdb1ZEKFhwyTda9 AIckHJqfRbhFvN9vmke0TzvuWGamrGRhOvzpDRtsxq8OZvK3u11fuvJEmnsB3TkpQf/tnCMn1s+ P6F9K9XtqfqaI8Aued8Sdgt5QI3Qhixis3NSU9TK7+UnCrH8gEFlZQv2HfoionCcX2nFhmXERd2 kqA3JYkuTZLcEz+aVGbDm487aL9jUycwDObkgJSG9UwNxj0OTzKyKNWegWxiSjEmroFb3JtHbPh NdH+TYSviveEzSWYdy/L3UXJfWKrRMLHtLcsAzbMleX4x8gGaxlU47cCG8AYtM X-Received: by 2002:a05:600c:22d6:b0:48a:5618:b4d4 with SMTP id 5b1f17b1804b1-48ffd828d6emr1692195e9.1.1779122125101; Mon, 18 May 2026 09:35:25 -0700 (PDT) Received: from localhost ([2a00:79e0:288a:8:866a:e549:273b:bc0]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48fe57944c1sm288997405e9.7.2026.05.18.09.35.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 09:35:24 -0700 (PDT) From: Jann Horn Subject: [PATCH 0/2] proc: protect ptrace_may_access() with exec_update_lock Date: Mon, 18 May 2026 18:35:14 +0200 Message-Id: <20260518-procfs-lockfix-part1-v1-0-5c3d20e0ac33@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-B4-Tracking: v=1; b=H4sIAMI/C2oC/x2MQQrDIBAAvxL23AUVDE2+Unow65ouCVHWEgLBv 1d6HIaZGyqrcIV5uEH5lCr56GAfA9AnHCujxM7gjBuNt08smilV3DNtSS4sQb8WfaTg4uQXsg5 6WpS7/G9f79Z+wvvYyWYAAAA= X-Change-ID: 20260518-procfs-lockfix-part1-5dca2d95bc12 To: Alexander Viro , Christian Brauner Cc: Jan Kara , Arjan van de Ven , "Eric W. Biederman" , Jake Edge , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, Jann Horn , stable@vger.kernel.org X-Mailer: b4 0.15-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1779122120; l=1555; i=jannh@google.com; s=20240730; h=from:subject:message-id; bh=lADZGL1l+uV+dRUhIFGvk44P/1X//TbM0Q/BhApFkWk=; b=IwpfuQofLx1OaD/Oq+E+Ekv+BwOYk72drXWLQP391fiPqwH7SfjOaqsx9Fjg87efduRYWBxLd Ine6lmQsfUvC2OWy+okwbW5YXqypA2GqF7rISgDZkLkJKNNyTHDU5Np X-Developer-Key: i=jannh@google.com; a=ed25519; pk=AljNtGOzXeF6khBXDJVVvwSEkVDGnnZZYqfWhP1V+C8= My understanding is that procfs is effectively maintained by the VFS maintainers (though scripts/get_maintainer.pl claims that there are no maintainers for procfs because the VFS entry only claims files directly in fs/, and the procfs entry has no maintainers listed on it). In procfs, most uses of ptrace_may_access() should use exec_update_lock to avoid TOCTOU issues with concurrent privileged execve() (like setuid binary execution). This series doesn't fix all the remaining issues in procfs, but it fixes the easy cases for now; I will probably follow up with fixes for the gnarlier cases later unless someone else wants to do that. I have checked that procfs files still work with these changes and that CONFIG_PROVE_LOCKING=y doesn't generate any warnings. (checkpatch complains about missing argument names in proc_op::proc_get_link, but that was already the case before my patch.) Signed-off-by: Jann Horn --- Jann Horn (2): proc: protect ptrace_may_access() with exec_update_lock (part 1) proc: protect ptrace_may_access() with exec_update_lock (FD links) fs/proc/array.c | 6 ++ fs/proc/base.c | 159 ++++++++++++++++++++++----------------------------- fs/proc/fd.c | 27 ++++----- fs/proc/internal.h | 2 +- fs/proc/namespaces.c | 12 ++++ 5 files changed, 97 insertions(+), 109 deletions(-) --- base-commit: 5200f5f493f79f14bbdc349e402a40dfb32f23c8 change-id: 20260518-procfs-lockfix-part1-5dca2d95bc12 -- Jann Horn