github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: cfg80211: Pin module for debugfs file operations

Browse Source 
An open debugfs file retains its file_operations pointer in the
debugfs proxy state. However, the file_operations defined by the
DEBUGFS_READONLY_FILE and DEBUGFS_RADIO_READONLY_FILE macros, as well
as ht40allow_map_ops in net/wireless/debugfs.c, have no .owner set to
THIS_MODULE.

As a result, full_proxy_open_regular() calls fops_get() which succeeds
without taking a reference to the cfg80211 module. When CONFIG_CFG80211=m
and wireless debugfs is enabled, a userspace process can open any of these
debugfs files (e.g. /sys/kernel/debug/ieee80211/phy0/rts_threshold or
ht40allow_map) and keep the file descriptor open while the module is
unloaded (rmmod cfg80211).

When the userspace process subsequently closes the descriptor,
full_proxy_release() accesses the already unmapped file_operations
structure, triggering a kernel oops in full_proxy_release():

  BUG: unable to handle page fault for address: fffffbfff8056f03
  #PF: supervisor read access in kernel mode
  Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:full_proxy_release+0x8e/0x140
  Call Trace:
   <TASK>
   __fput+0x39f/0xa60
   fput_close_sync+0xff/0x200
   __x64_sys_close+0x8c/0xf0
   do_syscall_64+0x115/0x6a0
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

The issue was discovered via manual code audit of
net/wireless/debugfs.c.

Set .owner = THIS_MODULE on all debugfs file_operations tables in
net/wireless/debugfs.c so that debugfs pins the module until all open
file descriptors have been closed.

Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
Link: https://patch.msgid.link/20261008052936.555554-1-dungvn2345@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Bui Viet Dung 2026-10-08 12:29:36 +07:00 committed by Johannes Berg
parent 507b014f7f
commit ad0726b61b
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/wireless/debugfs.c
View File

@ -24,6 +24,7 @@ static ssize_t name## _read(struct file *file, char __user *userbuf, \
} \
\
static const struct file_operations name## _ops = { \
.owner = THIS_MODULE, \
.read = name## _read, \
.open = simple_open, \
.llseek = generic_file_llseek, \
@ -42,6 +43,7 @@ static ssize_t name## _read(struct file *file, char __user *userbuf, \
} \
\
static const struct file_operations name## _ops = { \
.owner = THIS_MODULE, \
.read = name## _read, \
.open = simple_open, \
.llseek = generic_file_llseek, \
@ -113,6 +115,7 @@ static ssize_t ht40allow_map_read(struct file *file,
}
static const struct file_operations ht40allow_map_ops = {
.owner = THIS_MODULE,
.read = ht40allow_map_read,
.open = simple_open,
.llseek = default_llseek,