• Nicolai Stange's avatar
    debugfs: open_proxy_open(): avoid double fops release · 75f0b68b
    Nicolai Stange authored
    Debugfs' open_proxy_open(), the ->open() installed at all inodes created
    through debugfs_create_file_unsafe(),
    - grabs a reference to the original file_operations instance passed to
      debugfs_create_file_unsafe() via fops_get(),
    - installs it at the file's ->f_op by means of replace_fops()
    - and calls fops_put() on it.
    
    Since the semantics of replace_fops() are such that the reference's
    ownership is transferred, the subsequent fops_put() will result in a double
    release when the file is eventually closed.
    
    Currently, this is not an issue since fops_put() basically does a
    module_put() on the file_operations' ->owner only and there don't exist any
    modules calling debugfs_create_file_unsafe() yet. This is expected to
    change in the future though, c.f. commit c6468808 ("debugfs: add
    support for self-protecting attribute file fops").
    
    Remove the call to fops_put() from open_proxy_open().
    
    Fixes: 9fd4dcec ("debugfs: prevent access to possibly dead
                          file_operations at file open")
    Signed-off-by: default avatarNicolai Stange <nicstange@gmail.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    75f0b68b
file.c 38.3 KB