[PATCH] ocfs2: Pin the node manager module for open debugfs files

[PATCH] ocfs2: Pin the node manager module for open debugfs files

[Cen Zhang]

The node manager debugfs file operation tables do not set owner.
The debugfs full proxy obtains real_fops with fops_get() at open and
keeps it until final release. Without an owner, this does not acquire
a module reference. Normal unload can free the ocfs2_nodemanager
module image while an open file still holds its operation table.

Closing connected_nodes then makes full_proxy_release() read
real_fops->release from freed module memory. Removing the debugfs
entries during module exit does not drain retained open files.

Set owner to THIS_MODULE in the o2net and heartbeat debugfs operation
tables. The existing debugfs get/put pair then keeps the module and
its callbacks alive until the last open file is released.

A controlled test used an unloadable OCFS2 module and case-local probe
filters without changing the candidate open, unload or release logic.
Closing a retained connected_nodes file after normal unload produced:

  BUG: unable to handle page fault for address: fffffbfff804cfef
  Oops: Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:full_proxy_release+0xbf/0x190
  Call Trace:
   <TASK>
   __fput+0x39a/0xa60
   fput_close_sync+0xff/0x200
   __x64_sys_close+0x8c/0xf0
   do_syscall_64+0x114/0x620
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>
  Modules linked in: [last unloaded: ocfs2_nodemanager]

Fixes: 2309e9e040fe ("ocfs2/net: Add debug interface to o2net")
Fixes: 87d3d3f3931f ("ocfs2/hb: Expose the list of heartbeating nodes via debugfs")
Fixes: 3ba169ccec1c ("ocfs2/cluster: Add new function o2net_fill_node_map()")
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 8e6ead433228..1d4f71190d27 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -1447,6 +1447,7 @@ static ssize_t o2hb_debug_read(struct file *file, char __user *buf,
 #endif  /* CONFIG_DEBUG_FS */
 
 static const struct file_operations o2hb_debug_fops = {
+	.owner = THIS_MODULE,
 	.open =		o2hb_debug_open,
 	.release =	o2hb_debug_release,
 	.read =		o2hb_debug_read,
diff --git a/fs/ocfs2/cluster/netdebug.c b/fs/ocfs2/cluster/netdebug.c
index f7ab66e70799..5d373002297d 100644
--- a/fs/ocfs2/cluster/netdebug.c
+++ b/fs/ocfs2/cluster/netdebug.c
@@ -183,6 +183,7 @@ static int nst_fop_release(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations nst_seq_fops = {
+	.owner = THIS_MODULE,
 	.open = nst_fop_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
@@ -415,6 +416,7 @@ static int stats_fop_open(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations stats_seq_fops = {
+	.owner = THIS_MODULE,
 	.open = stats_fop_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
@@ -427,6 +429,7 @@ static int sc_fop_open(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations sc_seq_fops = {
+	.owner = THIS_MODULE,
 	.open = sc_fop_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
@@ -476,6 +479,7 @@ static ssize_t o2net_debug_read(struct file *file, char __user *buf,
 }
 
 static const struct file_operations nodes_fops = {
+	.owner		= THIS_MODULE,
 	.open		= nodes_fop_open,
 	.release	= o2net_debug_release,
 	.read		= o2net_debug_read,

Re: [PATCH] ocfs2: Pin the node manager module for open debugfs files

[Heming Zhao]

On Mon, Oct 12, 2026 at 09:31:38AM +0800, Cen Zhang wrote:
> The node manager debugfs file operation tables do not set owner.
> The debugfs full proxy obtains real_fops with fops_get() at open and
> keeps it until final release. Without an owner, this does not acquire
> a module reference. Normal unload can free the ocfs2_nodemanager
> module image while an open file still holds its operation table.
> 
> Closing connected_nodes then makes full_proxy_release() read
> real_fops->release from freed module memory. Removing the debugfs
> entries during module exit does not drain retained open files.
> 
> Set owner to THIS_MODULE in the o2net and heartbeat debugfs operation
> tables. The existing debugfs get/put pair then keeps the module and
> its callbacks alive until the last open file is released.
> 
> A controlled test used an unloadable OCFS2 module and case-local probe
> filters without changing the candidate open, unload or release logic.
> Closing a retained connected_nodes file after normal unload produced:
> 
>   BUG: unable to handle page fault for address: fffffbfff804cfef
>   Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>   RIP: 0010:full_proxy_release+0xbf/0x190
>   Call Trace:
>    <TASK>
>    __fput+0x39a/0xa60
>    fput_close_sync+0xff/0x200
>    __x64_sys_close+0x8c/0xf0
>    do_syscall_64+0x114/0x620
>    entry_SYSCALL_64_after_hwframe+0x77/0x7f
>    </TASK>
>   Modules linked in: [last unloaded: ocfs2_nodemanager]
> 
> Fixes: 2309e9e040fe ("ocfs2/net: Add debug interface to o2net")
> Fixes: 87d3d3f3931f ("ocfs2/hb: Expose the list of heartbeating nodes via debugfs")
> Fixes: 3ba169ccec1c ("ocfs2/cluster: Add new function o2net_fill_node_map()")
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>


Thanks for spotting this. I applied the same test to 
/sys/kernel/debug/ocfs2/<id>/fs_state and confirmed the same issue.
It looks like all debugfs ops in ocfs2 are missing .owner.
Would you have time to check and fix them?

Thanks,
Heming
> ---
> diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
> index 8e6ead433228..1d4f71190d27 100644
> --- a/fs/ocfs2/cluster/heartbeat.c
> +++ b/fs/ocfs2/cluster/heartbeat.c
> @@ -1447,6 +1447,7 @@ static ssize_t o2hb_debug_read(struct file *file, char __user *buf,
>  #endif  /* CONFIG_DEBUG_FS */
>  
>  static const struct file_operations o2hb_debug_fops = {
> +	.owner = THIS_MODULE,
>  	.open =		o2hb_debug_open,
>  	.release =	o2hb_debug_release,
>  	.read =		o2hb_debug_read,
> diff --git a/fs/ocfs2/cluster/netdebug.c b/fs/ocfs2/cluster/netdebug.c
> index f7ab66e70799..5d373002297d 100644
> --- a/fs/ocfs2/cluster/netdebug.c
> +++ b/fs/ocfs2/cluster/netdebug.c
> @@ -183,6 +183,7 @@ static int nst_fop_release(struct inode *inode, struct file *file)
>  }
>  
>  static const struct file_operations nst_seq_fops = {
> +	.owner = THIS_MODULE,
>  	.open = nst_fop_open,
>  	.read = seq_read,
>  	.llseek = seq_lseek,
> @@ -415,6 +416,7 @@ static int stats_fop_open(struct inode *inode, struct file *file)
>  }
>  
>  static const struct file_operations stats_seq_fops = {
> +	.owner = THIS_MODULE,
>  	.open = stats_fop_open,
>  	.read = seq_read,
>  	.llseek = seq_lseek,
> @@ -427,6 +429,7 @@ static int sc_fop_open(struct inode *inode, struct file *file)
>  }
>  
>  static const struct file_operations sc_seq_fops = {
> +	.owner = THIS_MODULE,
>  	.open = sc_fop_open,
>  	.read = seq_read,
>  	.llseek = seq_lseek,
> @@ -476,6 +479,7 @@ static ssize_t o2net_debug_read(struct file *file, char __user *buf,
>  }
>  
>  static const struct file_operations nodes_fops = {
> +	.owner		= THIS_MODULE,
>  	.open		= nodes_fop_open,
>  	.release	= o2net_debug_release,
>  	.read		= o2net_debug_read,

Re: [PATCH] ocfs2: Pin the node manager module for open debugfs files

[Cen Zhang]

Hi Heming,

>
> Thanks for spotting this. I applied the same test to
> /sys/kernel/debug/ocfs2/<id>/fs_state and confirmed the same issue.
> It looks like all debugfs ops in ocfs2 are missing .owner.
> Would you have time to check and fix them?
>
> Thanks,
> Heming
>

Thank you for the reviewing.

I’ll go through the rest of them, add the missing .owner = THIS_MODULE
where needed.

Best regards,
Cen Zhang