From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3084A3B9D98 for ; Thu, 8 Oct 2026 12:28:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791462536; cv=none; b=cXSaLphEYKdGy6Mp055nZnmsWCgrgfQHSQtgRCagt53y648mAeUtmkJ6RBMkEapCRU6ucAJaRgFmlzcEOyFfq9b3FFy/jarz9R7hUVD/ZFvPpnTL5X0YX1m0xuS4TgPTX2OEkXVCFnGfjjB1YCY5CCNPLg7W/ptFaxfRBwA6zPQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791462536; c=relaxed/simple; bh=IbVo6s7b5sBB9lnd9tmlCLjiyw9VvCQfz+4RT3BW5pM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=No0/yJle9JDm1WA2UrvmDS+5TopXrcOK7+RX9lbmTMj4i+FYpmlLdpctrM/5ePeDHMfNgdD/4xcBXyIvciHUHlcT/2MJw7mkDjPUOpxlgUTqtRBr98Yuaa9B4O7caJ+F+3cKDp3coi1cCzC31cZF/YBjMhECSwc91CZp55gyIVA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NfbDHTSx; arc=none smtp.client-ip=209.85.214.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NfbDHTSx" Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2db80fcdf8bso21934675ad.2 for ; Thu, 08 Oct 2026 05:28:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791462534; x=1792067334; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=COAThH0ap4EmFyle9qndKOJa6dHiJ8hI93mqQf8LdaM=; b=NfbDHTSxcSTnBm4E49y/qbTrOaokcCeDllIcPxd04VMni+t9gQoUXdK7fK7/W7D21L yCjPNY0DV0GUepQl1+2YP3xsAJ8jvU2b2j/FyCherRbziOcXx8njM0sUWc9+QARH6tWm oA4IEMMfuOJ9vJypwm9GCHcOwHCbfVwQeki4/jL+dQxsTBUSdE0FPMwofUkJRr43fZZO X2dRc6gqR6QtcYdkYcjq2XG4DgNucIA2LU+vJE3477kZmfanmWPbhCCIuqKHXLKgZj2f AoZ7rGSBIGZzxB6J7XCQZYyvacRYjzQQ3wQyCV6iGR6mMQjdUD5HWkl6oQp6BuRlEhIV iCXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791462534; x=1792067334; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=COAThH0ap4EmFyle9qndKOJa6dHiJ8hI93mqQf8LdaM=; b=QELAFBJGA5KreFIuZOw+Dl3AdQy06elnkQgA+1SKlSNFejxlT7dny1WK40QToXshAf KaXILK3CdS6QZdmxkiuKOHFQtQ4HC4bad+F4jISBfzIqY4GSuo9asPuw20NXfPcYL3VF Aw7Cjd0lyGV6kZu47Yl6sCs8rIKf5fXqH6jacbstC+hlHmKYe7fzdRRTYPury5Hkt/R3 FcI1WUHJeZ4X/iVhaB5AMFwIgV9VHPVidz8XkFIAB/XNcS6bS9z8vj3p8gwl/2kjqhiY fPZTbHwDyCfx0ngPtL1Mri3K8EjHcBO8ZFXAY0KzFewKLXQzIifkmcoceo29ILNS5Dds VUXA== X-Forwarded-Encrypted: i=1; AKwUvBz5kWBIoKW5o9Z2Z5gAmYcQ2zUVf1J8oaiFGnKR4Ys8u0dc9fG5SoI9dTdKX820l80sBRLYRdGv8e0Bcf0=@vger.kernel.org X-Gm-Message-State: AFq9FYIsjSv+xZnJMmZXid6jRnVQ6mnPsVzM1zyRKIluwFp7AJcltgZH sBY7NSbYNJlfyZy6sRQY87AlK9tcIN3a4bHGU92ks0Ni/tjtqGUNskvMb29qTA== X-Gm-Gg: AYBFou20249CBpMHE53hbLa9oTQyO+K1KBy+QULweSmHDohwWz5UXPYvtrHVOCl4T/C BJ8HCv/ZVzZo7hceSUy9+Qc9gHeMqowSgdlGrU8B8G03EP2soHNVIfiySTRCzXxE8YuCEEADy25 WUnO1UJmvLstkIa1xLrOLsNVkrmIGwvZ5xqeAEo6CCiR2aJOTcml8/HVD0Y1n2Ik0QcoSMjuuyQ VHsRjOS9ottnRBcQ8MqOxLfJoOhUWBT4QN9XHJwE01ALuNePlM2nkJuBO8Fog30sWnX6DB+gvMY rQy9kpQJumF5IUgkVaXhjFiTrN8MMZgEWFMRqa0zjsOPuBS56o1TTezGt9YxFB7gvNudHCzRnv5 0L2X9v+gVkqur0iuMBHj34HE1amt3KDEnJzsJYHfVjd3SrUsPiVvhdU/6gDyqHmXSuHEXW/QneS 0PwdZeus6W+OjUu2KXre5BDQmIzNKWDKxfEdC56M+7lXq9m6SrM6Dn8Qj/yd/FJYiunQ== X-Received: by 2002:a17:902:ce07:b0:2e2:de8e:7315 with SMTP id d9443c01a7336-2e6004d2ccemr43775815ad.38.1791462534502; Thu, 08 Oct 2026 05:28:54 -0700 (PDT) Received: from dungbv.. ([58.186.69.27]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e60443810asm22985415ad.9.2026.10.08.05.28.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 08 Oct 2026 05:28:49 -0700 (PDT) From: Bui Viet Dung To: Johannes Berg Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Bui Viet Dung , stable@vger.kernel.org Subject: [PATCH] wifi: mac80211_hwsim: Pin module for debugfs file operations Date: Thu, 8 Oct 2026 19:28:38 +0700 Message-ID: <20261008122838.224835-1-dungvn2345@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit An open debugfs file retains its file_operations pointer in the debugfs proxy state. However, hwsim_background_cac_ops and hwsim_simulate_incumbent_signal_fops in mac80211_hwsim_main.c have no .owner set to THIS_MODULE. As a result, full_proxy_open_regular() calls fops_get() which succeeds without taking a reference to the mac80211_hwsim module. When a userspace process opens either of these debugfs files, a subsequent module unload (rmmod mac80211_hwsim) can succeed while the file descriptor remains open. When the userspace process subsequently closes the descriptor, full_proxy_release() accesses the already unmapped file_operations structure, triggering a kernel oops in full_proxy_release(): BUG: unable to handle page fault for address: fffffbfff84f49e7 Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:full_proxy_release+0x8e/0x140 Call Trace: __fput+0x39f/0xa60 __x64_sys_close+0x80/0xe0 do_syscall_64+0xc3/0x590 entry_SYSCALL_64_after_hwframe+0x76/0x7e The issue was discovered via manual code audit of mac80211_hwsim_main.c and reproduced on a Linux 7.3-rc6 test VM with CONFIG_MAC80211_HWSIM=m. Set .owner = THIS_MODULE on both debugfs file_operations structures in mac80211_hwsim_main.c so that debugfs pins the module until close has completed. Cc: stable@vger.kernel.org Signed-off-by: Bui Viet Dung --- drivers/net/wireless/virtual/mac80211_hwsim_main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c index b9446577ff49..3ae46d78d68a 100644 --- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c +++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c @@ -1149,6 +1149,7 @@ static ssize_t hwsim_background_cac_write(struct file *file, } static const struct file_operations hwsim_background_cac_ops = { + .owner = THIS_MODULE, .write = hwsim_background_cac_write, .open = simple_open, .llseek = default_llseek, @@ -1209,6 +1210,7 @@ static ssize_t hwsim_simulate_incumbent_signal_write(struct file *file, } static const struct file_operations hwsim_simulate_incumbent_signal_fops = { + .owner = THIS_MODULE, .open = simple_open, .write = hwsim_simulate_incumbent_signal_write, }; -- 2.43.0