From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755553AbcEXLJu (ORCPT ); Tue, 24 May 2016 07:09:50 -0400 Received: from mail-wm0-f65.google.com ([74.125.82.65]:33602 "EHLO mail-wm0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755465AbcEXLJZ (ORCPT ); Tue, 24 May 2016 07:09:25 -0400 From: Nicolai Stange To: Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org, Nicolai Stange Subject: [PATCH 3/3] debugfs: open_proxy_open(): avoid double fops release Date: Tue, 24 May 2016 13:08:54 +0200 Message-Id: <1464088134-6001-4-git-send-email-nicstange@gmail.com> X-Mailer: git-send-email 2.8.2 In-Reply-To: <1464088134-6001-1-git-send-email-nicstange@gmail.com> References: <1464088134-6001-1-git-send-email-nicstange@gmail.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Debugfs' open_proxy_open(), the ->open() installed at all inodes created through debugfs_create_file_unsafe(), - grabs a reference to the original file_operations instance passed to debugfs_create_file_unsafe() via fops_get(), - installs it at the file's ->f_op by means of replace_fops() - and calls fops_put() on it. Since the semantics of replace_fops() are such that the reference's ownership is transferred, the subsequent fops_put() will result in a double release when the file is eventually closed. Currently, this is not an issue since fops_put() basically does a module_put() on the file_operations' ->owner only and there don't exist any modules calling debugfs_create_file_unsafe() yet. This is expected to change in the future though, c.f. commit c64688081490 ("debugfs: add support for self-protecting attribute file fops"). Remove the call to fops_put() from open_proxy_open(). Fixes: 9fd4dcece43a ("debugfs: prevent access to possibly dead file_operations at file open") Signed-off-by: Nicolai Stange --- fs/debugfs/file.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c index d1ec803..592059f 100644 --- a/fs/debugfs/file.c +++ b/fs/debugfs/file.c @@ -127,7 +127,6 @@ static int open_proxy_open(struct inode *inode, struct file *filp) r = real_fops->open(inode, filp); out: - fops_put(real_fops); debugfs_use_file_finish(srcu_idx); return r; } -- 2.8.2