[PATCH v2 56/57][B] debugfs: open_proxy_open(): avoid double fops release
Seth Forshee
seth.forshee at canonical.com
Fri Jun 19 16:16:20 UTC 2020
From: Nicolai Stange <nicstange at gmail.com>
BugLink: https://bugs.launchpad.net/bugs/1884159
Debugfs' open_proxy_open(), the ->open() installed at all inodes created
through debugfs_create_file_unsafe(),
- grabs a reference to the original file_operations instance passed to
debugfs_create_file_unsafe() via fops_get(),
- installs it at the file's ->f_op by means of replace_fops()
- and calls fops_put() on it.
Since the semantics of replace_fops() are such that the reference's
ownership is transferred, the subsequent fops_put() will result in a double
release when the file is eventually closed.
Currently, this is not an issue since fops_put() basically does a
module_put() on the file_operations' ->owner only and there don't exist any
modules calling debugfs_create_file_unsafe() yet. This is expected to
change in the future though, c.f. commit c64688081490 ("debugfs: add
support for self-protecting attribute file fops").
Remove the call to fops_put() from open_proxy_open().
Fixes: 9fd4dcece43a ("debugfs: prevent access to possibly dead
file_operations at file open")
Signed-off-by: Nicolai Stange <nicstange at gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
(cherry picked from commit 75f0b68b75dabb3ff551440163fd67b3fc62901a)
Signed-off-by: Seth Forshee <seth.forshee at canonical.com>
---
fs/debugfs/file.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index d1ec80331414..592059f88e04 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -127,7 +127,6 @@ static int open_proxy_open(struct inode *inode, struct file *filp)
r = real_fops->open(inode, filp);
out:
- fops_put(real_fops);
debugfs_use_file_finish(srcu_idx);
return r;
}
--
2.27.0
More information about the kernel-team
mailing list