From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f51.google.com (mail-dl1-f51.google.com [74.125.82.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DDAAF337BA3 for ; Mon, 15 Jun 2026 10:47:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781520481; cv=none; b=juNmIYgfahH5VbY623ZODN3EHye0K/1ORRbIfaBCUhQXO5Df7V9T9Yj3Vxy7dUQIQJZA0zbqYE9b8Lw/8uGan8cnnfvJdTbCZqEsiiyuSCAfXgrbLKGG7iVRp44LCboIjvofwrIRsAqyIlA29aopiNKkEtx23Fcm5yYSfPdje8g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781520481; c=relaxed/simple; bh=WJa4UCVH02RHe9+Oq31r/RrrcBb96N2j4OM1JKwV2Ig=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=eYjsUYbO19nSOmPEJtwZ0lrNw3tpya9lHRDXgvzJSAbv98MZIU16D+Axj1jutDSv35JIppRrhAFCjwFqS1eZIQfL3f7wF+afwnP+FZ17e3a6DdfTzHW+0evrnm3pCYLGUlQgk3r4xHSwtunbChosDTJY0hj5I0Nbp6qABL/7e9c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=jifd+g8L; arc=none smtp.client-ip=74.125.82.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="jifd+g8L" Received: by mail-dl1-f51.google.com with SMTP id a92af1059eb24-13809223fd4so3245455c88.1 for ; Mon, 15 Jun 2026 03:47:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781520478; x=1782125278; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=eD5p1FqpKBE/WpLH7RPMIfnZsLIdey33cIaJtrksyMY=; b=jifd+g8LSiYrnw3KRiC4cW2qqe5NgT3B0wGTZKVbYL1W11sFhdbm1j1f38eysN1OKd SJKY1sd52d3r+uGjbOeN4bZ270lTjdHAUmq0Q4+ft7wFFRT3tA3tazIYWnVarSOqeE8Q 0DeDrPXKP5PdbN6uN3lQQW5kzYieiDyVFKe0lCN0zP8TkekMaZQA2tIIk8qycOhFGGDQ LS5Bd/gkMAUHUpBqzpjgWHWPOLd/oFCPxfThUVeEEgvyoP4+X7UXqAzqYgXxXw0r4HhX Cyk8eU/kx3NMi9cYtSFsLj7YWXmhgaNQim9zkISo9NR57KVYpTI0QnkTeEIopGxNoY3K 08xw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781520478; x=1782125278; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=eD5p1FqpKBE/WpLH7RPMIfnZsLIdey33cIaJtrksyMY=; b=GmkSnXy2CAORfta23HjpjtSI/Bsr71rSdg58rCiGSSGJQOP+OqxDXbAeTw4jlSeCMX xUrSLM4G5KlZRAfN9grXqVZlNv95e8HoQwyIMh9QZyhvJ+n4/CJ0ADSJQVfwJ65bp1N2 N7kJM6frFdVRlZrNCkCKe+7FToJjKytdEd36B/nLhi7V7LyMa+y1OLUwP/ZXErOCOUpq fRBO7nuXxSX+uLKEv9cWZ3GKfng4QW/uVmKA9C3KncOHFmC5vpDtadWHTe2VJRe7wRtA a7vK14wnLkXOXJO5iajEkUCX2/UVboZrZil+VI5fvi5AnYfRZw9i+lSZGaIqjJJZaw97 S2Zg== X-Forwarded-Encrypted: i=1; AFNElJ9WFQDYOiFObJePMSf1eWSk8dzkDE6FiXKNk658/kWNOBx7KPWCqFthb9iPH/3ZY/0TXBtqe1ZH/c+sDQs=@vger.kernel.org X-Gm-Message-State: AOJu0YwHTsPTEUbgh3ce7bI79HHcd3R1bDhyX8zUHFNS0UgL9kUosWNB sp623gLm3pEf/w5K6UCtPWrMZxjr1Es9z/AiTurbVUWWR3iGz+hZO4Ki X-Gm-Gg: Acq92OEKutQ8LAX4UZVGnE4KI449oxZvbw0bKafnF/5MkTMEj7lRBI7q+EFPt9LlBwr +5OP0GoPTOa6ThVMWAJGwdFZD2eDzKrJCRklCkmrbj12DXNVegPuhrEg6UOh2RpszY7KjvOE1BZ GmgiKuQRpchBrgQotqATb99/zQ/IbTU7+gBCqQtb/ToAPgP1V1fCGufEijg0U2sd7zX5uD4rNJo 1Djzc+ziSHT5RN7NXaxUU4b1g4CWZ7i0FDTzI+prlc+fNOm/GNbGdTtUJuJWMaDzSPQuEyagrRO cNZLQivl4QrIjJs2o9D5gZvTSTVqbROxShiXDCC9YMDZlO/4R7tVYBxkTo/o//Mi5AzURkxLIiw QB+IHmGgPtGbbSSOUpuihoiitOAZpGRNa+7aktODh9touUkFEQur60MBkQPCGrmXXiQ4moWokqo UM4GbAavS0qxAl64Cgjq0UlA== X-Received: by 2002:a05:7300:501:b0:2ef:83d4:647f with SMTP id 5a478bee46e88-30820096d98mr7471008eec.25.1781520477763; Mon, 15 Jun 2026 03:47:57 -0700 (PDT) Received: from linux-691t.suse.cz ([124.11.22.254]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3081e48e412sm15480774eec.4.2026.06.15.03.47.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 15 Jun 2026 03:47:57 -0700 (PDT) From: Chun-Yi Lee X-Google-Original-From: Chun-Yi Lee To: "Rafael J . Wysocki" Cc: Chun-Yi Lee , David Howells , Lorenzo Stoakes , Andy Shevchenko , Thomas Gleixner , Matthew Garrett , Greg Kroah-Hartman , Danilo Krummrich , driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2] debugfs: Fix lockdown check for mmap_prepare Date: Mon, 15 Jun 2026 18:47:50 +0800 Message-ID: <20260615104750.1000-1-jlee@suse.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Chun-Yi Lee Commit 651fdda8406d ("relay: update relay to use mmap_prepare") changed the `mmap` file operation to `mmap_prepare` for relayfs, but the lockdown check in debugfs was not updated accordingly. This prevents debugfs from being locked down when the kernel is in integrity mode if a file uses `mmap_prepare` but not `mmap`. Since the conversion to `mmap_prepare` across the kernel is not yet complete, update the lockdown check to look for both `mmap` and `mmap_prepare` to ensure comprehensive coverage. Fixes: 651fdda8406d ("relay: update relay to use mmap_prepare") Signed-off-by: Chun-Yi Lee Cc: David Howells Cc: Lorenzo Stoakes Cc: Andy Shevchenko Cc: Thomas Gleixner Cc: Rafael J. Wysocki Cc: Matthew Garrett Cc: Greg Kroah-Hartman Cc: Danilo Krummrich Cc: driver-core@lists.linux.dev Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org --- v2: - Add explicit From tag to match Signed-off-by. - Fix Lorenzo's email address. - Add Cc stable for backporting. - Check both mmap and mmap_prepare as suggested by Lorenzo. fs/debugfs/file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c index edd6aafbfbaa..08de6652a4f3 100644 --- a/fs/debugfs/file.c +++ b/fs/debugfs/file.c @@ -273,7 +273,8 @@ static int debugfs_locked_down(struct inode *inode, (!real_fops || (!real_fops->unlocked_ioctl && !real_fops->compat_ioctl && - !real_fops->mmap))) + !real_fops->mmap && + !real_fops->mmap_prepare))) return 0; if (security_locked_down(LOCKDOWN_DEBUGFS)) -- 2.43.0