]> git.baikalelectronics.ru Git - kernel.git/commit
debugfs: open_proxy_open(): avoid double fops release
authorNicolai Stange <nicstange@gmail.com>
Tue, 24 May 2016 11:08:54 +0000 (13:08 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 15 Jun 2016 11:56:35 +0000 (04:56 -0700)
commit2cdae13c3045fb0eaa78e4c77b4171fc25810641
tree244a5ab2bfd5823bcfd9bbe15c3dff3c8491588c
parent6c12f5a7c0af2aafb7742bb0047d6c5ce6419bfe
debugfs: open_proxy_open(): avoid double fops release

Debugfs' open_proxy_open(), the ->open() installed at all inodes created
through debugfs_create_file_unsafe(),
- grabs a reference to the original file_operations instance passed to
  debugfs_create_file_unsafe() via fops_get(),
- installs it at the file's ->f_op by means of replace_fops()
- and calls fops_put() on it.

Since the semantics of replace_fops() are such that the reference's
ownership is transferred, the subsequent fops_put() will result in a double
release when the file is eventually closed.

Currently, this is not an issue since fops_put() basically does a
module_put() on the file_operations' ->owner only and there don't exist any
modules calling debugfs_create_file_unsafe() yet. This is expected to
change in the future though, c.f. commit ce43a082c966 ("debugfs: add
support for self-protecting attribute file fops").

Remove the call to fops_put() from open_proxy_open().

Fixes: e7b500b1ebf4 ("debugfs: prevent access to possibly dead
                      file_operations at file open")
Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/debugfs/file.c