[PATCH] Bluetooth: selftest: Pin module for selftest debugfs file operations

[PATCH] Bluetooth: selftest: Pin module for selftest debugfs file operations

[Bui Viet Dung]

An open debugfs file retains its file_operations pointer in the
debugfs proxy state. However, test_smp_fops in net/bluetooth/smp.c and
test_ecdh_fops in net/bluetooth/selftest.c have no .owner set to
THIS_MODULE.

As a result, full_proxy_open_regular() calls fops_get() which succeeds
without taking a reference to the bluetooth module. When CONFIG_BT=m
and selftests are enabled, a userspace process can open either
/sys/kernel/debug/bluetooth/selftest_smp or
/sys/kernel/debug/bluetooth/selftest_ecdh and keep the file descriptor
open while the module is unloaded (rmmod bluetooth).

When the userspace process subsequently closes the descriptor,
full_proxy_release() accesses the already unmapped file_operations
structure, triggering a kernel oops in full_proxy_release():

  BUG: unable to handle page fault for address: fffffbfff8056f03
  #PF: supervisor read access in kernel mode
  Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:full_proxy_release+0x8e/0x140
  Call Trace:
   <TASK>
   __fput+0x39f/0xa60
   fput_close_sync+0xff/0x200
   __x64_sys_close+0x8c/0xf0
   do_syscall_64+0x115/0x6a0
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

The issue was discovered via manual code audit of net/bluetooth/smp.c
and net/bluetooth/selftest.c.

Set .owner = THIS_MODULE on test_smp_fops and test_ecdh_fops so that
debugfs keeps the module pinned until the file descriptors are closed.

Fixes: 64dd374eac15 ("Bluetooth: Export SMP selftest result in debugfs")
Fixes: 6de50f9fdb60 ("Bluetooth: Export ECDH selftest result in debugfs")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
---
 net/bluetooth/selftest.c | 1 +
 net/bluetooth/smp.c      | 1 +
 2 files changed, 2 insertions(+)

diff --git a/net/bluetooth/selftest.c b/net/bluetooth/selftest.c
index ae5b44bb9d3d..cdfc40e0016b 100644
--- a/net/bluetooth/selftest.c
+++ b/net/bluetooth/selftest.c
@@ -188,6 +188,7 @@ static ssize_t test_ecdh_read(struct file *file, char __user *user_buf,
 }
 
 static const struct file_operations test_ecdh_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= test_ecdh_read,
 	.llseek		= default_llseek,
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 2df303f6a38f..81d255525fe0 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -3696,6 +3696,7 @@ static ssize_t test_smp_read(struct file *file, char __user *user_buf,
 }
 
 static const struct file_operations test_smp_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= test_smp_read,
 	.llseek		= default_llseek,
-- 
2.43.0

RE: Bluetooth: selftest: Pin module for selftest debugfs file operations

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1072 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1181261/

---Test result---

Test Summary:
CheckPatch                    PASS      0.70 seconds
VerifyFixes                   PASS      0.11 seconds
VerifySignedoff               PASS      0.11 seconds
GitLint                       PASS      0.28 seconds
SubjectPrefix                 PASS      0.36 seconds
BuildKernel                   PASS      20.04 seconds
CheckAllWarning               PASS      23.81 seconds
CheckSparse                   PASS      24.21 seconds
BuildKernel32                 PASS      19.30 seconds
CheckKernelLLVM               PASS      20.46 seconds
TestRunnerSetup               PASS      451.64 seconds
TestRunner_smp-tester         PASS      7.05 seconds
IncrementalBuild              PASS      21.55 seconds



https://github.com/bluez/bluetooth-next/pull/885

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: selftest: Pin module for selftest debugfs file operations

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu,  8 Oct 2026 12:18:03 +0700 you wrote:
> An open debugfs file retains its file_operations pointer in the
> debugfs proxy state. However, test_smp_fops in net/bluetooth/smp.c and
> test_ecdh_fops in net/bluetooth/selftest.c have no .owner set to
> THIS_MODULE.
> 
> As a result, full_proxy_open_regular() calls fops_get() which succeeds
> without taking a reference to the bluetooth module. When CONFIG_BT=m
> and selftests are enabled, a userspace process can open either
> /sys/kernel/debug/bluetooth/selftest_smp or
> /sys/kernel/debug/bluetooth/selftest_ecdh and keep the file descriptor
> open while the module is unloaded (rmmod bluetooth).
> 
> [...]

Here is the summary with links:
  - Bluetooth: selftest: Pin module for selftest debugfs file operations
    https://git.kernel.org/bluetooth/bluetooth-next/c/839c7cdc250c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html