From 507b014f7f744b2a1317e87babe7c20b7d950f72 Mon Sep 17 00:00:00 2001 From: Bui Viet Dung Date: Thu, 8 Oct 2026 12:24:12 +0700 Subject: [PATCH] wifi: mac80211: Pin module for hwflags debugfs file operations An open debugfs file retains its file_operations pointer in the debugfs proxy state. However, hwflags_ops in net/mac80211/debugfs.c has no .owner set to THIS_MODULE. As a result, full_proxy_open_regular() calls fops_get() which succeeds without taking a reference to the mac80211 module. When CONFIG_MAC80211=m and wireless debugfs is enabled, a userspace process can open the hwflags debugfs file and keep the file descriptor open while the module is unloaded (rmmod mac80211). When the userspace process subsequently closes the descriptor, full_proxy_release() accesses the already unmapped file_operations structure, triggering a kernel oops in full_proxy_release(): BUG: unable to handle page fault for address: fffffbfff8056f03 #PF: supervisor read access in kernel mode Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:full_proxy_release+0x8e/0x140 Call Trace: __fput+0x39f/0xa60 fput_close_sync+0xff/0x200 __x64_sys_close+0x8c/0xf0 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The issue was discovered via manual code audit of net/mac80211/debugfs.c. Set .owner = THIS_MODULE on hwflags_ops so that debugfs pins the module until all open file descriptors have been closed. Signed-off-by: Bui Viet Dung Link: https://patch.msgid.link/20261008052412.541780-1-dungvn2345@gmail.com Signed-off-by: Johannes Berg --- net/mac80211/debugfs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c index 1f914b48e3bb..a8f677cfc77e 100644 --- a/net/mac80211/debugfs.c +++ b/net/mac80211/debugfs.c @@ -529,6 +529,7 @@ static ssize_t hwflags_write(struct file *file, const char __user *user_buf, } static const struct file_operations hwflags_ops = { + .owner = THIS_MODULE, .open = simple_open, .read = hwflags_read, .write = hwflags_write,