From 2a3e2287877b1ee40ffb80b7d769b633866533f3 Mon Sep 17 00:00:00 2001 From: Bui Viet Dung Date: Thu, 8 Oct 2026 12:01:40 +0700 Subject: [PATCH] Bluetooth: hci_debugfs: Pin module for debugfs file operations An open debugfs file retains its file_operations pointer in the debugfs proxy state. However, the file_operations defined in hci_debugfs.c (use_debug_keys_fops, sc_only_mode_fops, ssp_debug_mode_fops, force_bredr_smp_fops, force_static_address_fops, force_no_mitm_fops, dut_mode_fops, vendor_diag_fops, and the DEFINE_QUIRK_ATTRIBUTE macro) have no .owner set to THIS_MODULE. As a result, full_proxy_open_regular() calls fops_get() which succeeds without taking a reference to the bluetooth module. When a userspace process opens any of these debugfs files, a subsequent controller removal and module unload (rmmod bluetooth) can succeed while the file descriptor remains open. When the userspace process subsequently closes the descriptor, full_proxy_release() accesses the already unmapped file_operations structure, triggering a kernel oops in full_proxy_release(): BUG: unable to handle page fault for address: fffffbfff8056f03 #PF: supervisor read access in kernel mode Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:full_proxy_release+0x8e/0x140 Call Trace: __fput+0x39f/0xa60 fput_close_sync+0xff/0x200 __x64_sys_close+0x8c/0xf0 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The issue was discovered via manual code audit of net/bluetooth/hci_debugfs.c and verified on a Linux 7.3-rc6 test VM with CONFIG_BT=m. Set .owner = THIS_MODULE on all debugfs file_operations tables in hci_debugfs.c so that debugfs keeps the module loaded until close has finished. Fixes: 0886aea6acd2 ("Bluetooth: Expose debug keys usage setting via debugfs") Cc: stable@vger.kernel.org Signed-off-by: Bui Viet Dung Signed-off-by: Luiz Augusto von Dentz --- net/bluetooth/hci_debugfs.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c index 2559fb6324d6..cd5ef398f238 100644 --- a/net/bluetooth/hci_debugfs.c +++ b/net/bluetooth/hci_debugfs.c @@ -65,6 +65,7 @@ static ssize_t __name ## _write(struct file *file, \ } \ \ static const struct file_operations __name ## _fops = { \ + .owner = THIS_MODULE, \ .open = simple_open, \ .read = __name ## _read, \ .write = __name ## _write, \ @@ -283,6 +284,7 @@ static ssize_t use_debug_keys_read(struct file *file, char __user *user_buf, } static const struct file_operations use_debug_keys_fops = { + .owner = THIS_MODULE, .open = simple_open, .read = use_debug_keys_read, .llseek = default_llseek, @@ -301,6 +303,7 @@ static ssize_t sc_only_mode_read(struct file *file, char __user *user_buf, } static const struct file_operations sc_only_mode_fops = { + .owner = THIS_MODULE, .open = simple_open, .read = sc_only_mode_read, .llseek = default_llseek, @@ -437,6 +440,7 @@ static ssize_t ssp_debug_mode_read(struct file *file, char __user *user_buf, } static const struct file_operations ssp_debug_mode_fops = { + .owner = THIS_MODULE, .open = simple_open, .read = ssp_debug_mode_read, .llseek = default_llseek, @@ -529,6 +533,7 @@ static ssize_t force_bredr_smp_write(struct file *file, } static const struct file_operations force_bredr_smp_fops = { + .owner = THIS_MODULE, .open = simple_open, .read = force_bredr_smp_read, .write = force_bredr_smp_write, @@ -778,6 +783,7 @@ static ssize_t force_static_address_write(struct file *file, } static const struct file_operations force_static_address_fops = { + .owner = THIS_MODULE, .open = simple_open, .read = force_static_address_read, .write = force_static_address_write, @@ -1177,6 +1183,7 @@ static ssize_t force_no_mitm_write(struct file *file, } static const struct file_operations force_no_mitm_fops = { + .owner = THIS_MODULE, .open = simple_open, .read = force_no_mitm_read, .write = force_no_mitm_write, @@ -1315,6 +1322,7 @@ static ssize_t dut_mode_write(struct file *file, const char __user *user_buf, } static const struct file_operations dut_mode_fops = { + .owner = THIS_MODULE, .open = simple_open, .read = dut_mode_read, .write = dut_mode_write, @@ -1371,6 +1379,7 @@ static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf, } static const struct file_operations vendor_diag_fops = { + .owner = THIS_MODULE, .open = simple_open, .read = vendor_diag_read, .write = vendor_diag_write,