Re: Yet another pipe related oops.

[Al Viro <viro@ZenIV.linux.org.uk>]

On Tue, Apr 02, 2013 at 12:27:18AM +0100, Al Viro wrote:
> On Mon, Apr 01, 2013 at 02:44:36PM -0700, Greg Kroah-Hartman wrote:
> > > > I guess you are right, it will not.  I guess we need to do what
> > > > character devices do and have an "intermediate" fops in order to protect
> > > > this.  Would that work?
> > > 
> > > You mean, with reassigning ->f_op in ->open()?  That'll work, as long as
> > > we have exclusion between removal and fetching the sucker in primary
> > > ->open()...  Where would you prefer to stash fops?
> > 
> > Ick, that's not going to work as the current api just uses a fops and
> > debugfs doesn't keep anything else hanging around that referes to
> > something "before" that, like 'struct cdev' does.
> 
> Er?  How about just sticking it into dentry->d_fsdata and letting
> debugfs_remove() zero that out?  What am I missing here?

Hrm...  For what it's worth, how do debugfs entries associated with
dynamic objects deal with debugfs_remove() vs. method calls?  I don't
see _anything_ in {,__}debugfs_remove() that would looks like "wait
for ongoing write(2) attempts to complete".  IOW, forget rmmod - WTF
protects us from access-after-free for any kind of data that isn't
permanently allocated?