Skip to contentSkip to conversation

patch "carl9170: fix debugfs crashes" added to driver-core-next

PATCH [email protected] 1 participant 1 message Sep 21, 2016

Subsystems (2)
Stable branch CARL9170 Linux community wireless driver
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

carl9170: fix debugfs crashes

to my driver-core git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git
in the driver-core-next branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will also be merged in the next major kernel release during the merge window.

If you have any questions about this process, please let me know.

Quoted 1 line

From 6ee6d1cb391ca85b419f8d18bdfb1f020a5e859c Mon Sep 17 00:00:00 2001

From: Christian Lamparter <[email protected]>
Date: Wed, 21 Sep 2016 18:49:36 +0200
Subject: carl9170: fix debugfs crashes

Ben Greear reported:

Quoted 7 lines

I see lots of instability as soon as I load up the carl9710 NIC. My application is going to be poking at it's debugfs files...

BUG: KASAN: slab-out-of-bounds in carl9170_debugfs_read+0xd5/0x2a0
[carl9170] at addr 0xffff8801bc1208b0
Read of size 8 by task btserver/5888
=======================================================================
Quoted 5 lines

BUG kmalloc-256 (Tainted: G W ): kasan: bad access detected
-----------------------------------------------------------------------

INFO: Allocated in seq_open+0x50/0x100 age=2690 cpu=2 pid=772
...

This breakage was caused by the introduction of intermediate fops in debugfs by commit 9fd4dcece43a
("debugfs: prevent access to possibly dead file_operations at file open")

Thankfully, the original/real fops are still available in d_fsdata.

Reported-by Ben Greear <[email protected]>
Signed-off-by Christian Lamparter <[email protected]>
Cc stable <[email protected]> # 4.7+
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/net/wireless/ath/carl9170/debug.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/carl9170/debug.c +4 -2
index 6808db433283..ec3a64e5d2bb 100644
@@ -75,7 +75,8 @@ static ssize_t carl9170_debugfs_read(struct file *file, char __user *userbuf,
 
 	if (!ar)
 		return -ENODEV;
-	dfops = container_of(file->f_op, struct carl9170_debugfs_fops, fops);
+	dfops = container_of(debugfs_real_fops(file),
+			     struct carl9170_debugfs_fops, fops);
 
 	if (!dfops->read)
 		return -ENOSYS;

@@ -127,7 +128,8 @@ static ssize_t carl9170_debugfs_write(struct file *file,
 
 	if (!ar)
 		return -ENODEV;
-	dfops = container_of(file->f_op, struct carl9170_debugfs_fops, fops);
+	dfops = container_of(debugfs_real_fops(file),
+			     struct carl9170_debugfs_fops, fops);
 
 	if (!dfops->write)
 		return -ENOSYS;
Signature · 1 line
2.10.0