[PATCH] wwan: wwan_hwsim: Pin module for debugfs file operations

[PATCH] wwan: wwan_hwsim: Pin module for debugfs file operations

[Bui Viet Dung]

An open debugfs file retains its file_operations pointer in the
debugfs proxy state. However, wwan_hwsim_debugfs_portdestroy_fops,
wwan_hwsim_debugfs_portcreate_fops, wwan_hwsim_debugfs_devdestroy_fops,
and wwan_hwsim_debugfs_devcreate_fops in wwan_hwsim.c have no
.owner set to THIS_MODULE.

As a result, full_proxy_open_regular() calls fops_get() which succeeds
without taking a reference to the wwan_hwsim module. When a userspace
process opens any of these debugfs files, a subsequent module unload
(rmmod wwan_hwsim) can succeed while the file descriptor remains open.

When the userspace process subsequently closes the descriptor,
full_proxy_release() accesses the already unmapped file_operations
structure, triggering a kernel oops in full_proxy_release():

  BUG: unable to handle page fault for address: fffffbfff84f90ef
  Oops: 0000 [#2] SMP KASAN NOPTI
  RIP: 0010:full_proxy_release+0x8e/0x140
  Call Trace:
   <TASK>
   __fput+0x357/0xaa0
   fput_close_sync+0xe6/0x1a0
   file_close_fd_locked+0x17e/0x2f0
   do_close+0x33/0x70
   __x64_sys_close+0x44/0x80
   do_syscall_64+0xc3/0x590
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
   </TASK>

The issue was discovered via manual code audit of wwan_hwsim.c and
reproduced on a Linux 7.3-rc6 test VM with CONFIG_WWAN_HWSIM=m.

Set .owner = THIS_MODULE on all four debugfs file_operations structures
in wwan_hwsim.c so that debugfs pins the module until close has
completed.

Fixes: 9ee23f48f670 ("wwan_hwsim: add debugfs management interface")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
---
 drivers/net/wwan/wwan_hwsim.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wwan/wwan_hwsim.c b/drivers/net/wwan/wwan_hwsim.c
index c3c2d2a68767..34eea3edc824 100644
--- a/drivers/net/wwan/wwan_hwsim.c
+++ b/drivers/net/wwan/wwan_hwsim.c
@@ -500,6 +500,7 @@ static ssize_t wwan_hwsim_debugfs_portdestroy_write(struct file *file,
 }
 
 static const struct file_operations wwan_hwsim_debugfs_portdestroy_fops = {
+	.owner = THIS_MODULE,
 	.write = wwan_hwsim_debugfs_portdestroy_write,
 	.open = simple_open,
 	.llseek = noop_llseek,
@@ -524,6 +525,7 @@ static ssize_t wwan_hwsim_debugfs_portcreate_write(struct file *file,
 }
 
 static const struct file_operations wwan_hwsim_debugfs_portcreate_fops = {
+	.owner = THIS_MODULE,
 	.write = wwan_hwsim_debugfs_portcreate_write,
 	.open = simple_open,
 	.llseek = noop_llseek,
@@ -545,6 +547,7 @@ static ssize_t wwan_hwsim_debugfs_devdestroy_write(struct file *file,
 }
 
 static const struct file_operations wwan_hwsim_debugfs_devdestroy_fops = {
+	.owner = THIS_MODULE,
 	.write = wwan_hwsim_debugfs_devdestroy_write,
 	.open = simple_open,
 	.llseek = noop_llseek,
@@ -568,6 +571,7 @@ static ssize_t wwan_hwsim_debugfs_devcreate_write(struct file *file,
 }
 
 static const struct file_operations wwan_hwsim_debugfs_devcreate_fops = {
+	.owner = THIS_MODULE,
 	.write = wwan_hwsim_debugfs_devcreate_write,
 	.open = simple_open,
 	.llseek = noop_llseek,
-- 
2.43.0

Re: [PATCH] wwan: wwan_hwsim: Pin module for debugfs file operations

[Loic Poulain]

On Thu, Oct 8, 2026 at 3:08 PM Bui Viet Dung <dungvn2345@gmail.com> wrote:
>
> An open debugfs file retains its file_operations pointer in the
> debugfs proxy state. However, wwan_hwsim_debugfs_portdestroy_fops,
> wwan_hwsim_debugfs_portcreate_fops, wwan_hwsim_debugfs_devdestroy_fops,
> and wwan_hwsim_debugfs_devcreate_fops in wwan_hwsim.c have no
> .owner set to THIS_MODULE.
>
> As a result, full_proxy_open_regular() calls fops_get() which succeeds
> without taking a reference to the wwan_hwsim module. When a userspace
> process opens any of these debugfs files, a subsequent module unload
> (rmmod wwan_hwsim) can succeed while the file descriptor remains open.
>
> When the userspace process subsequently closes the descriptor,
> full_proxy_release() accesses the already unmapped file_operations
> structure, triggering a kernel oops in full_proxy_release():
>
>   BUG: unable to handle page fault for address: fffffbfff84f90ef
>   Oops: 0000 [#2] SMP KASAN NOPTI
>   RIP: 0010:full_proxy_release+0x8e/0x140
>   Call Trace:
>    <TASK>
>    __fput+0x357/0xaa0
>    fput_close_sync+0xe6/0x1a0
>    file_close_fd_locked+0x17e/0x2f0
>    do_close+0x33/0x70
>    __x64_sys_close+0x44/0x80
>    do_syscall_64+0xc3/0x590
>    entry_SYSCALL_64_after_hwframe+0x76/0x7e
>    </TASK>
>
> The issue was discovered via manual code audit of wwan_hwsim.c and
> reproduced on a Linux 7.3-rc6 test VM with CONFIG_WWAN_HWSIM=m.
>
> Set .owner = THIS_MODULE on all four debugfs file_operations structures
> in wwan_hwsim.c so that debugfs pins the module until close has
> completed.
>
> Fixes: 9ee23f48f670 ("wwan_hwsim: add debugfs management interface")
> Cc: stable@vger.kernel.org
> Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>

Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>

> ---
>  drivers/net/wwan/wwan_hwsim.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/net/wwan/wwan_hwsim.c b/drivers/net/wwan/wwan_hwsim.c
> index c3c2d2a68767..34eea3edc824 100644
> --- a/drivers/net/wwan/wwan_hwsim.c
> +++ b/drivers/net/wwan/wwan_hwsim.c
> @@ -500,6 +500,7 @@ static ssize_t wwan_hwsim_debugfs_portdestroy_write(struct file *file,
>  }
>
>  static const struct file_operations wwan_hwsim_debugfs_portdestroy_fops = {
> +       .owner = THIS_MODULE,
>         .write = wwan_hwsim_debugfs_portdestroy_write,
>         .open = simple_open,
>         .llseek = noop_llseek,
> @@ -524,6 +525,7 @@ static ssize_t wwan_hwsim_debugfs_portcreate_write(struct file *file,
>  }
>
>  static const struct file_operations wwan_hwsim_debugfs_portcreate_fops = {
> +       .owner = THIS_MODULE,
>         .write = wwan_hwsim_debugfs_portcreate_write,
>         .open = simple_open,
>         .llseek = noop_llseek,
> @@ -545,6 +547,7 @@ static ssize_t wwan_hwsim_debugfs_devdestroy_write(struct file *file,
>  }
>
>  static const struct file_operations wwan_hwsim_debugfs_devdestroy_fops = {
> +       .owner = THIS_MODULE,
>         .write = wwan_hwsim_debugfs_devdestroy_write,
>         .open = simple_open,
>         .llseek = noop_llseek,
> @@ -568,6 +571,7 @@ static ssize_t wwan_hwsim_debugfs_devcreate_write(struct file *file,
>  }
>
>  static const struct file_operations wwan_hwsim_debugfs_devcreate_fops = {
> +       .owner = THIS_MODULE,
>         .write = wwan_hwsim_debugfs_devcreate_write,
>         .open = simple_open,
>         .llseek = noop_llseek,
> --
> 2.43.0
>