Commit 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc files")
missed a key part in the definition of proc_dir_entry:

union {
	const struct proc_ops *proc_ops;
	const struct file_operations *proc_dir_ops;
};

So dereference of ->proc_ops assumes it is a proc_ops structure results in
type confusion and make NULL check for 'proc_ops' not work for proc dir.

Add !S_ISDIR(dp->mode) test before calling pde_set_flags() to fix it.

Fixes: 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc files")
Reported-by: Brad Spengler <spender@grsecurity.net>
Signed-off-by: wangzijie <wangzijie1@honor.com>
---
 fs/proc/generic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index bd0c099cf..176281112 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -393,7 +393,8 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
 	if (proc_alloc_inum(&dp->low_ino))
 		goto out_free_entry;
 
-	pde_set_flags(dp);
+	if (!S_ISDIR(dp->mode))
+		pde_set_flags(dp);
 
 	write_lock(&proc_subdir_lock);
 	dp->parent = dir;
-- 
2.25.1

On Thu, 4 Sep 2025 21:57:15 +0800 wangzijie <wangzijie1@honor.com> wrote:

> Commit 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc files")
> missed a key part in the definition of proc_dir_entry:
> 
> union {
> 	const struct proc_ops *proc_ops;
> 	const struct file_operations *proc_dir_ops;
> };
> 
> So dereference of ->proc_ops assumes it is a proc_ops structure results in
> type confusion and make NULL check for 'proc_ops' not work for proc dir.
> 
> Add !S_ISDIR(dp->mode) test before calling pde_set_flags() to fix it.
> 
> Fixes: 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc files")

2ce3d282bd50 had cc:stable, so I added cc:stable to this patch.

> Reported-by: Brad Spengler <spender@grsecurity.net>
> Signed-off-by: wangzijie <wangzijie1@honor.com>

A link to Brad's report would be helpful please, if available.  We
typically use Closes: for such things.

> On Thu, 4 Sep 2025 21:57:15 +0800 wangzijie <wangzijie1@honor.com> wrote:
> 
> > Commit 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc files")
> > missed a key part in the definition of proc_dir_entry:
> > 
> > union {
> > 	const struct proc_ops *proc_ops;
> > 	const struct file_operations *proc_dir_ops;
> > };
> > 
> > So dereference of ->proc_ops assumes it is a proc_ops structure results in
> > type confusion and make NULL check for 'proc_ops' not work for proc dir.
> > 
> > Add !S_ISDIR(dp->mode) test before calling pde_set_flags() to fix it.
> > 
> > Fixes: 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc files")
> 
> 2ce3d282bd50 had cc:stable, so I added cc:stable to this patch.
> 
> > Reported-by: Brad Spengler <spender@grsecurity.net>
> > Signed-off-by: wangzijie <wangzijie1@honor.com>
> 
> A link to Brad's report would be helpful please, if available.  We
> typically use Closes: for such things.

Closes: https://lore.kernel.org/all/20250903065758.3678537-1-wangzijie1@honor.com/

Thanks for reminder, I'm not sure if this link is appropriate.