From: Cen Zhang <zzzccc427@gmail.com>
To: mark@fasheh.com, jlbec@evilplan.org, joseph.qi@linux.alibaba.com,
heming.zhao@suse.com, akpm@linux-foundation.org,
zzzccc427@gmail.com, kmehltretter@gmail.com,
ericterminal@gmail.com, kees@kernel.org,
sunil.mushran@oracle.com, christophe.jaillet@wanadoo.fr
Cc: ocfs2-devel@lists.linux.dev, linux-kernel@vger.kernel.org,
baijiaju1990@gmail.com, jjzuming@gmail.com
Subject: [PATCH] ocfs2: Pin the node manager module for open debugfs files
Date: Mon, 12 Oct 2026 09:31:38 +0800 [thread overview]
Message-ID: <pm-ocfs2-objects-candidate-0089-v2-4c67f48d4e2d0fc85990@gmail.com> (raw)
The node manager debugfs file operation tables do not set owner.
The debugfs full proxy obtains real_fops with fops_get() at open and
keeps it until final release. Without an owner, this does not acquire
a module reference. Normal unload can free the ocfs2_nodemanager
module image while an open file still holds its operation table.
Closing connected_nodes then makes full_proxy_release() read
real_fops->release from freed module memory. Removing the debugfs
entries during module exit does not drain retained open files.
Set owner to THIS_MODULE in the o2net and heartbeat debugfs operation
tables. The existing debugfs get/put pair then keeps the module and
its callbacks alive until the last open file is released.
A controlled test used an unloadable OCFS2 module and case-local probe
filters without changing the candidate open, unload or release logic.
Closing a retained connected_nodes file after normal unload produced:
BUG: unable to handle page fault for address: fffffbfff804cfef
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:full_proxy_release+0xbf/0x190
Call Trace:
<TASK>
__fput+0x39a/0xa60
fput_close_sync+0xff/0x200
__x64_sys_close+0x8c/0xf0
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Modules linked in: [last unloaded: ocfs2_nodemanager]
Fixes: 2309e9e040fe ("ocfs2/net: Add debug interface to o2net")
Fixes: 87d3d3f3931f ("ocfs2/hb: Expose the list of heartbeating nodes via debugfs")
Fixes: 3ba169ccec1c ("ocfs2/cluster: Add new function o2net_fill_node_map()")
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 8e6ead433228..1d4f71190d27 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -1447,6 +1447,7 @@ static ssize_t o2hb_debug_read(struct file *file, char __user *buf,
#endif /* CONFIG_DEBUG_FS */
static const struct file_operations o2hb_debug_fops = {
+ .owner = THIS_MODULE,
.open = o2hb_debug_open,
.release = o2hb_debug_release,
.read = o2hb_debug_read,
diff --git a/fs/ocfs2/cluster/netdebug.c b/fs/ocfs2/cluster/netdebug.c
index f7ab66e70799..5d373002297d 100644
--- a/fs/ocfs2/cluster/netdebug.c
+++ b/fs/ocfs2/cluster/netdebug.c
@@ -183,6 +183,7 @@ static int nst_fop_release(struct inode *inode, struct file *file)
}
static const struct file_operations nst_seq_fops = {
+ .owner = THIS_MODULE,
.open = nst_fop_open,
.read = seq_read,
.llseek = seq_lseek,
@@ -415,6 +416,7 @@ static int stats_fop_open(struct inode *inode, struct file *file)
}
static const struct file_operations stats_seq_fops = {
+ .owner = THIS_MODULE,
.open = stats_fop_open,
.read = seq_read,
.llseek = seq_lseek,
@@ -427,6 +429,7 @@ static int sc_fop_open(struct inode *inode, struct file *file)
}
static const struct file_operations sc_seq_fops = {
+ .owner = THIS_MODULE,
.open = sc_fop_open,
.read = seq_read,
.llseek = seq_lseek,
@@ -476,6 +479,7 @@ static ssize_t o2net_debug_read(struct file *file, char __user *buf,
}
static const struct file_operations nodes_fops = {
+ .owner = THIS_MODULE,
.open = nodes_fop_open,
.release = o2net_debug_release,
.read = o2net_debug_read,
next reply other threads:[~2026-10-12 1:31 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-12 1:31 Cen Zhang [this message]
2026-10-12 6:02 ` Heming Zhao
2026-10-12 12:01 ` Cen Zhang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=pm-ocfs2-objects-candidate-0089-v2-4c67f48d4e2d0fc85990@gmail.com \
--to=zzzccc427@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=baijiaju1990@gmail.com \
--cc=christophe.jaillet@wanadoo.fr \
--cc=ericterminal@gmail.com \
--cc=heming.zhao@suse.com \
--cc=jjzuming@gmail.com \
--cc=jlbec@evilplan.org \
--cc=joseph.qi@linux.alibaba.com \
--cc=kees@kernel.org \
--cc=kmehltretter@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mark@fasheh.com \
--cc=ocfs2-devel@lists.linux.dev \
--cc=sunil.mushran@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®