summaryrefslogtreecommitdiff
path: root/fs/debugfs
diff options
context:
space:
mode:
authorNicolai Stange <nicstange@gmail.com>2016-05-24 14:08:54 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2016-06-15 14:56:35 +0300
commit75f0b68b75dabb3ff551440163fd67b3fc62901a (patch)
tree244a5ab2bfd5823bcfd9bbe15c3dff3c8491588c /fs/debugfs
parentb10e3e90485e32e4cea9e35d2295ee7bffaeff73 (diff)
downloadlinux-75f0b68b75dabb3ff551440163fd67b3fc62901a.tar.xz
debugfs: open_proxy_open(): avoid double fops release
Debugfs' open_proxy_open(), the ->open() installed at all inodes created through debugfs_create_file_unsafe(), - grabs a reference to the original file_operations instance passed to debugfs_create_file_unsafe() via fops_get(), - installs it at the file's ->f_op by means of replace_fops() - and calls fops_put() on it. Since the semantics of replace_fops() are such that the reference's ownership is transferred, the subsequent fops_put() will result in a double release when the file is eventually closed. Currently, this is not an issue since fops_put() basically does a module_put() on the file_operations' ->owner only and there don't exist any modules calling debugfs_create_file_unsafe() yet. This is expected to change in the future though, c.f. commit c64688081490 ("debugfs: add support for self-protecting attribute file fops"). Remove the call to fops_put() from open_proxy_open(). Fixes: 9fd4dcece43a ("debugfs: prevent access to possibly dead file_operations at file open") Signed-off-by: Nicolai Stange <nicstange@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/debugfs')
-rw-r--r--fs/debugfs/file.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index d1ec80331414..592059f88e04 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -127,7 +127,6 @@ static int open_proxy_open(struct inode *inode, struct file *filp)
r = real_fops->open(inode, filp);
out:
- fops_put(real_fops);
debugfs_use_file_finish(srcu_idx);
return r;
}