From ad0726b61b85b0e75834581dcf9d00031dc5ec42 Mon Sep 17 00:00:00 2001 From: Bui Viet Dung Date: Thu, 8 Oct 2026 12:29:36 +0700 Subject: [PATCH] wifi: cfg80211: Pin module for debugfs file operations An open debugfs file retains its file_operations pointer in the debugfs proxy state. However, the file_operations defined by the DEBUGFS_READONLY_FILE and DEBUGFS_RADIO_READONLY_FILE macros, as well as ht40allow_map_ops in net/wireless/debugfs.c, have no .owner set to THIS_MODULE. As a result, full_proxy_open_regular() calls fops_get() which succeeds without taking a reference to the cfg80211 module. When CONFIG_CFG80211=m and wireless debugfs is enabled, a userspace process can open any of these debugfs files (e.g. /sys/kernel/debug/ieee80211/phy0/rts_threshold or ht40allow_map) and keep the file descriptor open while the module is unloaded (rmmod cfg80211). When the userspace process subsequently closes the descriptor, full_proxy_release() accesses the already unmapped file_operations structure, triggering a kernel oops in full_proxy_release(): BUG: unable to handle page fault for address: fffffbfff8056f03 #PF: supervisor read access in kernel mode Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:full_proxy_release+0x8e/0x140 Call Trace: __fput+0x39f/0xa60 fput_close_sync+0xff/0x200 __x64_sys_close+0x8c/0xf0 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The issue was discovered via manual code audit of net/wireless/debugfs.c. Set .owner = THIS_MODULE on all debugfs file_operations tables in net/wireless/debugfs.c so that debugfs pins the module until all open file descriptors have been closed. Signed-off-by: Bui Viet Dung Link: https://patch.msgid.link/20261008052936.555554-1-dungvn2345@gmail.com Signed-off-by: Johannes Berg --- net/wireless/debugfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c index f9e7fff1ef25..63503dbd8938 100644 --- a/net/wireless/debugfs.c +++ b/net/wireless/debugfs.c @@ -24,6 +24,7 @@ static ssize_t name## _read(struct file *file, char __user *userbuf, \ } \ \ static const struct file_operations name## _ops = { \ + .owner = THIS_MODULE, \ .read = name## _read, \ .open = simple_open, \ .llseek = generic_file_llseek, \ @@ -42,6 +43,7 @@ static ssize_t name## _read(struct file *file, char __user *userbuf, \ } \ \ static const struct file_operations name## _ops = { \ + .owner = THIS_MODULE, \ .read = name## _read, \ .open = simple_open, \ .llseek = generic_file_llseek, \ @@ -113,6 +115,7 @@ static ssize_t ht40allow_map_read(struct file *file, } static const struct file_operations ht40allow_map_ops = { + .owner = THIS_MODULE, .read = ht40allow_map_read, .open = simple_open, .llseek = default_llseek,