[PATCH] Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file

[PATCH] Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file

[Bui Viet Dung]

An open debugfs file retains lowpan_control_fops in the debugfs proxy
state. However, lowpan_control_fops has no .owner set to THIS_MODULE.
As a result, full_proxy_open_regular() calls fops_get() which succeeds
without taking a reference to the bluetooth_6lowpan module.

With CONFIG_BT_6LOWPAN=m, a userspace process can keep the debugfs file
descriptor for 6lowpan_control open across module unload
(delete_module / rmmod bluetooth_6lowpan). When the process subsequently
closes the file descriptor, full_proxy_release() accesses the already
freed and unmapped lowpan_control_fops table, causing a kernel page fault
or oops.

The issue was discovered via manual code audit of
net/bluetooth/6lowpan.c.

Set .owner = THIS_MODULE on lowpan_control_fops so that debugfs pins
the module until all open file descriptors have finished.

Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
---
 net/bluetooth/6lowpan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 30f4afa18bc8..20fb20eea8e7 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -1209,6 +1209,7 @@ static int lowpan_control_open(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations lowpan_control_fops = {
+	.owner		= THIS_MODULE,
 	.open		= lowpan_control_open,
 	.read		= seq_read,
 	.write		= lowpan_control_write,
-- 
2.43.0

RE: Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1072 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1181259/

---Test result---

Test Summary:
CheckPatch                    PASS      0.54 seconds
VerifyFixes                   PASS      0.07 seconds
VerifySignedoff               PASS      0.07 seconds
GitLint                       PASS      0.18 seconds
SubjectPrefix                 PASS      0.15 seconds
BuildKernel                   PASS      17.44 seconds
CheckAllWarning               PASS      20.27 seconds
CheckSparse                   PASS      21.86 seconds
BuildKernel32                 PASS      17.87 seconds
CheckKernelLLVM               PASS      19.16 seconds
TestRunnerSetup               PASS      435.12 seconds
TestRunner_6lowpan-tester     PASS      6.95 seconds
IncrementalBuild              PASS      17.61 seconds



https://github.com/bluez/bluetooth-next/pull/884

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu,  8 Oct 2026 12:11:29 +0700 you wrote:
> An open debugfs file retains lowpan_control_fops in the debugfs proxy
> state. However, lowpan_control_fops has no .owner set to THIS_MODULE.
> As a result, full_proxy_open_regular() calls fops_get() which succeeds
> without taking a reference to the bluetooth_6lowpan module.
> 
> With CONFIG_BT_6LOWPAN=m, a userspace process can keep the debugfs file
> descriptor for 6lowpan_control open across module unload
> (delete_module / rmmod bluetooth_6lowpan). When the process subsequently
> closes the file descriptor, full_proxy_release() accesses the already
> freed and unmapped lowpan_control_fops table, causing a kernel page fault
> or oops.
> 
> [...]

Here is the summary with links:
  - Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file
    https://git.kernel.org/bluetooth/bluetooth-next/c/b019e48cee2d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html