[PATCH] Bluetooth: hci_debugfs: Pin the module for open dut_mode files

[PATCH] Bluetooth: hci_debugfs: Pin the module for open dut_mode files

[Cen Zhang]

An open dut_mode file retains dut_mode_fops in the debugfs proxy state.
The table must remain allocated until the final close has finished
accessing it. However, dut_mode_fops has no owner, so fops_get()
succeeds without taking a Bluetooth module reference.

With CONFIG_BT=m and Bluetooth debugfs enabled, a descriptor can remain
open across controller removal and module unload if all other module
references have been dropped. After hci_debugfs_create_basic() publishes
the file, the following order is possible:

    File holder                     Controller/module teardown
    -----------                     --------------------------
    open dut_mode
      full_proxy_open_regular()
      fops_get(): owner == NULL
      debugfs_file_put()
    keep descriptor open            hci_unregister_dev()
                                    hci_release_dev()
                                      debugfs_remove_recursive()
                                    delete_module()
                                      bt_exit()
                                      free_module()
    close descriptor after unload
      full_proxy_release()
        read real_fops->release

Debugfs removal drains active callbacks, but an idle open descriptor is
not an active user. Its dentry retains the saved table pointer until
close. full_proxy_release() then reads the release field, even though
it is NULL, and fops_put() reads the owner field from freed module
storage. The close can fault in full_proxy_release(), as shown below.

Set the owner of dut_mode_fops to THIS_MODULE, matching the tables
created by DEFINE_SHOW_ATTRIBUTE in the same file. The existing debugfs
fops_get()/fops_put() pair then keeps Bluetooth loaded until close has
finished using the table, preventing normal unload with the file open.

Oops report as below:
    BUG: unable to handle page fault for address: fffffbfff8056f03
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page
    PGD 1a7ff6067 P4D 1a7ff6067 PUD 1a7ff2067 PMD 100ad6067 PTE 0
    Oops: Oops: 0000 [#1] SMP KASAN NOPTI
    Call Trace:
     <TASK>
     __fput+0x39f/0xa60
     fput_close_sync+0xff/0x200
     ? __pfx_fput_close_sync+0x10/0x10
     ? dnotify_flush+0x22/0x4b0
     __x64_sys_close+0x8c/0xf0
     do_syscall_64+0x115/0x6a0
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fixes: 4b4148e9acc1 ("Bluetooth: Add support for setting DUT mode")
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>

Assisted-by: LLM
---

diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
index 2559fb6324d63d5fc84d530d2a19f2602ac06d3d..f17b5c960522cb22140322e4781775e4e2f6b711 100644
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c
@@ -1315,6 +1315,7 @@ static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
 }
 
 static const struct file_operations dut_mode_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= dut_mode_read,
 	.write		= dut_mode_write,

RE: Bluetooth: hci_debugfs: Pin the module for open dut_mode files

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1605 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1181239/

---Test result---

Test Summary:
CheckPatch                    PASS      1.20 seconds
VerifyFixes                   PASS      0.14 seconds
VerifySignedoff               PASS      0.14 seconds
GitLint                       PASS      0.35 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      29.38 seconds
CheckAllWarning               PASS      33.30 seconds
CheckSparse                   PASS      35.97 seconds
BuildKernel32                 PASS      29.24 seconds
CheckKernelLLVM               PASS      34.87 seconds
TestRunnerSetup               PASS      778.98 seconds
TestRunner_l2cap-tester       PASS      12.84 seconds
TestRunner_iso-tester         PASS      10.64 seconds
TestRunner_bnep-tester        PASS      3.25 seconds
TestRunner_mgmt-tester        PASS      60.99 seconds
TestRunner_rfcomm-tester      PASS      4.46 seconds
TestRunner_sco-tester         PASS      5.86 seconds
TestRunner_ioctl-tester       PASS      4.66 seconds
TestRunner_mesh-tester        PASS      5.60 seconds
TestRunner_smp-tester         PASS      4.28 seconds
TestRunner_userchan-tester    PASS      3.17 seconds
TestRunner_6lowpan-tester     PASS      4.40 seconds
IncrementalBuild              PASS      28.31 seconds



https://github.com/bluez/bluetooth-next/pull/877

---
Regards,
Linux Bluetooth