Stable-bound /proc fixes close UAF, hangs, and readdir races

Christian Brauner has posted the first cut of a multi-part push to make procfs behave more like kernfs. The opening batch is not the conversion itself. It is a set of older bugs in /proc handlers that the review turned up, sent first so they can reach stable kernels on their own, with four selftests included.

Several of the flaws affect correctness under ordinary use. Directory listings in /proc and /proc/sys resumed by counted position, so an entry that appeared or vanished between getdents calls could be repeated or skipped, and a listing could end early when the entry being emitted disappeared. /proc/sys could also report EOF while entries remained if one was being unregistered mid-walk. Sysctl read, write, and readdir paths held the table while copying to or from userspace, so a long userspace fault could stall unregister_sysctl_table() and, through callers such as addrconf, block work that runs under the RTNL lock. Faulting readlink on a proc symlink similarly pinned the entry and could delay remove_proc_entry() behind locks held by ALSA card teardown.

Name handling produced sharper failures. Path resolution treated intermediate components as directories even when they were regular files, and pktgen lets unprivileged writers choose names that become /proc entries. A crafted name with a slash could hang an entry under another file and free it on removal, yielding a use-after-free once pktgen was loaded, without capabilities, inside a user-owned network namespace. Duplicate names chosen from userspace could also trip a WARN on registration and taint or crash a panic_on_warn kernel. Brauner now rejects slashes in pktgen names, refuses non-directory path components during registration, softens the duplicate-name report so it no longer WARNs under the global proc lock, and makes removal operate on the entry itself rather than a name lookup that could delete someone else's file after a race.

On NOMMU, every /proc file looked mappable. A private map of /proc/maps took the same lock the file's own read needs, so any user could hang the machine. Dying network namespaces could free /proc/net while leftover children still pointed at it; the code now warns. PowerPC fadump could run vmcore cleanup concurrently through separate writers and free lists still walked by readers, and old-memory copies lacked machine-check-safe paths that matter when splicing /proc/vmcore off a crashed kernel with bad RAM. Unterminated copies into SCSI host and UML exitcode writers, plus an NTFS3 label write that could trip the page allocator's warn path, complete the set.

Chris Mason reported several of the higher-impact cases. The conversion series that prompted the audit remains separate.