From patchwork Wed Feb 11 03:05:07 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Iooss X-Patchwork-Id: 5809831 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id E4722BF440 for ; Wed, 11 Feb 2015 03:17:35 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 0CDE8201ED for ; Wed, 11 Feb 2015 03:17:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1C48E200F3 for ; Wed, 11 Feb 2015 03:17:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751615AbbBKDRT (ORCPT ); Tue, 10 Feb 2015 22:17:19 -0500 Received: from mx1.polytechnique.org ([129.104.30.34]:33315 "EHLO mx1.polytechnique.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751256AbbBKDRS (ORCPT ); Tue, 10 Feb 2015 22:17:18 -0500 X-Greylist: delayed 609 seconds by postgrey-1.27 at vger.kernel.org; Tue, 10 Feb 2015 22:17:18 EST Received: from iosakhe.SUTD.EDU.SG (unknown [202.94.70.60]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) by ssl.polytechnique.org (Postfix) with ESMTPSA id 4E890140CD383; Wed, 11 Feb 2015 04:07:03 +0100 (CET) From: Nicolas Iooss To: Al Viro Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, Nicolas Iooss Subject: [PATCH] proc: get a reference to the owning module when opening file Date: Wed, 11 Feb 2015 11:05:07 +0800 Message-Id: <1423623907-6950-1-git-send-email-nicolas.iooss_linux@m4x.org> X-Mailer: git-send-email 2.3.0 X-AV-Checked: ClamAV using ClamSMTP at svoboda.polytechnique.org (Wed Feb 11 04:07:06 2015 +0100 (CET)) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When a module creates a file in procfs and a program uses the file with mmap, the .owner field of the file_operations structure is ignored. This allows removing the module while the file is still being used. Therefore this sequence of events leads to a kernel oops: * load a module which creates a file in procfs with an mmap operation * open the file * use mmap on it * rmmod the module * call unmap Here are parts of the oops caused by unmap: [ 1234.337725] BUG: unable to handle kernel paging request at ffffffffa030a268 [ 1234.338007] IP: [] remove_vma+0x24/0x70 [ 1234.338007] PGD 1c17067 PUD 1c18063 PMD 3d713067 PTE 0 [ 1234.338007] Oops: 0000 [#1] SMP [ 1234.338007] Modules linked in: fuse rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache cfg80211 rfkill ppdev bochs_drm virtio_net serio_raw parport_pc ttm pvpanic parport drm_kms_helper drm i2c_piix4 nfsd auth_rpcgss nfs_acl lockd sunrpc virtio_blk virtio_pci virtio_ring virtio ata_generic pata_acpi [last unloaded: procfs_mmap] [ 1234.338007] Call Trace: [ 1234.338007] [] do_munmap+0x27f/0x3b0 [ 1234.338007] [] vm_munmap+0x41/0x60 [ 1234.338007] [] SyS_munmap+0x22/0x30 [ 1234.338007] [] system_call_fastpath+0x16/0x1b Fix this by making proc_reg_open grab a reference to the module owning pde->proc_fops. More information and example code to reproduce this oops can be found on https://bugzilla.kernel.org/show_bug.cgi?id=92511 Signed-off-by: Nicolas Iooss --- fs/proc/inode.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 8420a2f80811..5df17cb730fa 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -329,12 +329,16 @@ static int proc_reg_open(struct inode *inode, struct file *file) kfree(pdeo); return -ENOENT; } + fops_get(pde->proc_fops); open = pde->proc_fops->open; release = pde->proc_fops->release; if (open) rv = open(inode, file); + if (rv != 0) + fops_put(pde->proc_fops); + if (rv == 0 && release) { /* To know what to release. */ pdeo->file = file; @@ -361,6 +365,7 @@ static int proc_reg_release(struct inode *inode, struct file *file) } } spin_unlock(&pde->pde_unload_lock); + fops_put(pde->proc_fops); return 0; }