• Nicolai Stange's avatar
    f2fs: set ->owner for debugfs status file's file_operations · fee2ddae
    Nicolai Stange authored
    [ Upstream commit 05e6ea26 ]
    
    The struct file_operations instance serving the f2fs/status debugfs file
    lacks an initialization of its ->owner.
    
    This means that although that file might have been opened, the f2fs module
    can still get removed. Any further operation on that opened file, releasing
    included,  will cause accesses to unmapped memory.
    
    Indeed, Mike Marshall reported the following:
    
      BUG: unable to handle kernel paging request at ffffffffa0307430
      IP: [<ffffffff8132a224>] full_proxy_release+0x24/0x90
      <...>
      Call Trace:
       [] __fput+0xdf/0x1d0
       [] ____fput+0xe/0x10
       [] task_work_run+0x8e/0xc0
       [] do_exit+0x2ae/0xae0
       [] ? __audit_syscall_entry+0xae/0x100
       [] ? syscall_trace_enter+0x1ca/0x310
       [] do_group_exit+0x44/0xc0
       [] SyS_exit_group+0x14/0x20
       [] do_syscall_64+0x61/0x150
       [] entry_SYSCALL64_slow_path+0x25/0x25
      <...>
      ---[ end trace f22ae883fa3ea6b8 ]---
      Fixing recursive fault but reboot is needed!
    
    Fix this by initializing the f2fs/status file_operations' ->owner with
    THIS_MODULE.
    
    This will allow debugfs to grab a reference to the f2fs module upon any
    open on that file, thus preventing it from getting removed.
    
    Fixes: 902829aa ("f2fs: move proc files to debugfs")
    Reported-by: default avatarMike Marshall <hubcap@omnibond.com>
    Reported-by: default avatarMartin Brandenburg <martin@omnibond.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarNicolai Stange <nicstange@gmail.com>
    Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
    fee2ddae
debug.c 13.1 KB