From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.214.199 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793048163; b=h/KMJ/7Vzr9zSg6kRKS99sO91Hkb2WH1rSsfsyQdg27wQGR4Skz9mzBnkUYDG4qL101x +JvW7VVTVhGv5rYbyKX4/BvArmM5wpiX5BCC6IQVr5B0Bh+D3iwpmh8AK4aMXgF6d2+Yx BBQUv0ChLaygsE7W0w5gdruhzHhk6VA3G4vQWdIbAuRVybTnVbXWguLHgJ9ytaNH2EotP 1ZITh+BqxYkZzGvk9hCKbUMMBBoL1uVDRsicJHzVCYau0zNvfM3YAnaXLrQLpTz3Kqm43 GrrTkpoVRGvi7WJum2ey9CIgA29e+Sb4GJZErQsHbqLEynMxQ9IDMNXb4mLZMUHM+Cw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793048163; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Date:Mime-Version: X-Mailer:Message-ID:Subject:From:To:Cc:Content-Type; bh=3B44qYC1y1oMWzUzev4ii49MY2PIUQMP+MPnvqlHD0k=; b=QDXgloXcpKkuT4FyPwx3lxJ82ZCv3w2iRxTfd9zCQ4pG2uQDcOstKd/C2ZH7JSXiFU35 ZL605SjEkVp4PootNBDkywJiPLilOiz91AJw4cEyn40ml5/NIRlpr5JW/+r7fzhX+26oz oo1+uP89mqFJ6lZsNGgUfl5QeDEAgW4H/CjWbmAvk+bOaiq8azYZ/pAE/14UMVnQhNIZt DIZ2rY1bHkE2ZaSE0a9TZJMTwDudJN31DuEkVULIk5H5piJ+8AJZ6xVn22a8jZXD6H3ca 07cSgH6Ld+7XuTj9yTx4eALkFPJ12ic2ZRhDhXvJs/6xk/7GKO94F3Wp95selHiKKUA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--skhawaja.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=A+AZHrl6; arc=none smtp.remote-ip=209.85.214.199 Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9FD3A606A31A for ; Mon, 26 Oct 2026 20:56:02 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 9FD3A606A31A Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--skhawaja.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=A+AZHrl6 Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2ea63087d79so35462725ad.3 for ; Mon, 26 Oct 2026 13:56:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1793048162; x=1793652962; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:mime-version:date:from :to:cc:subject:date:message-id:reply-to:content-type; bh=3B44qYC1y1oMWzUzev4ii49MY2PIUQMP+MPnvqlHD0k=; b=A+AZHrl65W8yvx+twdQ2Zl0C041QiC4aIxbw4UqrAJgWKUy+u+RrStSW3L1pSKiWVm quNPq3st7bcrd3lJyRLLcD1A8lh1kK9EOmzyi8SdigV6xrQ5qNrobNRhjwAo8qYPyU50 zcM2HA19Uj+e39zoGBi2DnF0jO6kD5qqVmVG+pAfuRJAI8O0PMyA9AEogFfulGKL+uA4 Um3UQce0OLoVrUoI9qfqHdCNGAmEtdK9dGvooFMieTMVJWwmFI9dn/G5jNLnm1LgPuTU 1/aAs/SiuNkKI7S+q/cPiUxeiTMp99WNhbVeYUaEOb5lfNXtfTIag6+E07E8H4lPkMQi y0sQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793048162; x=1793652962; h=content-type:cc:to:from:subject:message-id:mime-version:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=3B44qYC1y1oMWzUzev4ii49MY2PIUQMP+MPnvqlHD0k=; b=P5hNcDwj2eHy9cFDIgYzG+imDvgFxqXerPn9JaUFs9Kfb/7KkGboh/iGch4hyMO2Ei FuZ9hnSfy5KWjytJV2MCb23SGynMS0ANnr7cbl2i8HLI61yEtLUAEMo8Fw/OP21+Gsjp S/sM3T1KROK2SGg50ezjHNXTPxbYEJeXrtZngW0VabSH/Dd4/fqzkROEO4ybQarzV4wi mTauNY0/sDM4G23H6JVBbKGChJA9DQmEvJ8jBYkBMRkJKVIfRrFSXHqkKPYDKtuhzMs3 x96stwpgiFvdX4Nlfv2TXGhWR6nIp46k2PGwEg6TFsg9W4Zz0q7SqWmHICXnSODDNI4J 6Jjg== X-Forwarded-Encrypted: i=1; AKwUvBzT8P5eH6kPXSLgEV3mlZ4q9re4PZ9HGu/dbQ03aIBW+vli3CRn9iOlqmYaPXPW2CcWbri6NJCA7aLxYpY=@vger.kernel.org X-Gm-Message-State: AFq9FYIAoeyYePh4hvioW+j+9Kbp+ARp8gAqelmjHO6K7FSo4Dh5oJrY ljyheThq1XqUgG/X5egc/Vbo8yC9OHS38DBdVF3sMhyU8h6X0nsXn2HH+AGd/uDOY8DuXp+UqjI ZOUcQDhOB+romxw== X-Received: from plot20.prod.google.com ([2002:a17:902:8c94:b0:2e9:6468:1ffe]) (user=skhawaja job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:3806:b0:2e9:5175:2eb with SMTP id d9443c01a7336-2ea9c0f388fmr65823665ad.1.1793048161845; Mon, 26 Oct 2026 13:56:01 -0700 (PDT) Date: Mon, 26 Oct 2026 20:55:55 +0000 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 X-Mailer: git-send-email 2.56.0.307.g5fe7bd680c-goog Message-ID: <20261026205555.2918396-1-skhawaja@google.com> Subject: [PATCH] hugetlbfs: enforce F_SEAL_EXEC on chmod From: Samiullah Khawaja To: Andrew Morton , Muchun Song , Oscar Salvador Cc: David Hildenbrand , Jeff Xu , Daniel Verkamp , David Matlack , Pasha Tatashin , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Samiullah Khawaja , stable@vger.kernel.org Content-Type: text/plain; charset="UTF-8" F_SEAL_EXEC prevents the exec bits of a memfd from being changed once the seal has been set. F_SEAL_EXEC is included in F_ALL_SEALS, so userspace can set it with F_ADD_SEALS on hugetlbfs memfds just like on shmem memfds, and F_GET_SEALS then reports it as set. However, the check that rejects the mode change was only added to shmem_setattr(). hugetlbfs_setattr() never looks at the seal, so the owner of a sealed hugetlbfs memfd can still make it executable with chmod(). For the same reason, MFD_NOEXEC_SEAL provides no guarantee when it is combined with MFD_HUGETLB. The memfd selftest already covers this, but only the shmem run passes. When run as "memfd_test hugetlbfs", the test aborts in SEAL-EXEC because fchmod() succeeds on a sealed file, and none of the remaining tests are executed. Add the same check to hugetlbfs_setattr() that shmem_setattr() has, so that a mode change touching the exec bits fails with -EPERM while F_SEAL_EXEC is set. Fixes: 6fd7353829ca ("mm/memfd: add F_SEAL_EXEC") Cc: stable@vger.kernel.org Signed-off-by: Samiullah Khawaja --- fs/hugetlbfs/inode.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 01c4d6f44ebe..56e0588d295d 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -842,6 +842,10 @@ static int hugetlbfs_setattr(const struct mnt_idmap *idmap, trace_hugetlbfs_setattr(inode, dentry, attr); + if ((info->seals & F_SEAL_EXEC) && (ia_valid & ATTR_MODE) && + ((inode->i_mode ^ attr->ia_mode) & 0111)) + return -EPERM; + if (ia_valid & ATTR_SIZE) { loff_t oldsize = inode->i_size; loff_t newsize = attr->ia_size; base-commit: f1ac44c32cba88ad65dcecd4a279661d14e93651 -- 2.56.0.307.g5fe7bd680c-goog