| From 6ee6d1cb391ca85b419f8d18bdfb1f020a5e859c Mon Sep 17 00:00:00 2001 |
| From: Christian Lamparter <chunkeey@googlemail.com> |
| Date: Wed, 21 Sep 2016 18:49:36 +0200 |
| Subject: carl9170: fix debugfs crashes |
| |
| From: Christian Lamparter <chunkeey@googlemail.com> |
| |
| commit 6ee6d1cb391ca85b419f8d18bdfb1f020a5e859c upstream. |
| |
| Ben Greear reported: |
| > I see lots of instability as soon as I load up the carl9710 NIC. |
| > My application is going to be poking at it's debugfs files... |
| > |
| > BUG: KASAN: slab-out-of-bounds in carl9170_debugfs_read+0xd5/0x2a0 |
| > [carl9170] at addr 0xffff8801bc1208b0 |
| > Read of size 8 by task btserver/5888 |
| > ======================================================================= |
| > BUG kmalloc-256 (Tainted: G W ): kasan: bad access detected |
| > ----------------------------------------------------------------------- |
| > |
| > INFO: Allocated in seq_open+0x50/0x100 age=2690 cpu=2 pid=772 |
| >... |
| |
| This breakage was caused by the introduction of intermediate |
| fops in debugfs by commit 9fd4dcece43a |
| ("debugfs: prevent access to possibly dead file_operations at file open") |
| |
| Thankfully, the original/real fops are still available in d_fsdata. |
| |
| Reported-by: Ben Greear <greearb@candelatech.com> |
| Signed-off-by: Christian Lamparter <chunkeey@gmail.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/net/wireless/ath/carl9170/debug.c | 6 ++++-- |
| 1 file changed, 4 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/net/wireless/ath/carl9170/debug.c |
| +++ b/drivers/net/wireless/ath/carl9170/debug.c |
| @@ -75,7 +75,8 @@ static ssize_t carl9170_debugfs_read(str |
| |
| if (!ar) |
| return -ENODEV; |
| - dfops = container_of(file->f_op, struct carl9170_debugfs_fops, fops); |
| + dfops = container_of(debugfs_real_fops(file), |
| + struct carl9170_debugfs_fops, fops); |
| |
| if (!dfops->read) |
| return -ENOSYS; |
| @@ -127,7 +128,8 @@ static ssize_t carl9170_debugfs_write(st |
| |
| if (!ar) |
| return -ENODEV; |
| - dfops = container_of(file->f_op, struct carl9170_debugfs_fops, fops); |
| + dfops = container_of(debugfs_real_fops(file), |
| + struct carl9170_debugfs_fops, fops); |
| |
| if (!dfops->write) |
| return -ENOSYS; |
