Re: [PATCH v3 05/15] hugetlbfs: enforce F_SEAL_EXEC in setattr

[Oscar Salvador (SUSE)]

On Wed, Oct 28, 2026 at 10:55:03AM +0100, David Hildenbrand (Arm) wrote:
> From: Eva Kurchatova <eva.kurchatova@xxxxxxxxxxxxx>
> 
> F_SEAL_EXEC is enforced by shmem_setattr(), but hugetlbfs_setattr() does
> not check it. As a result, fchmod() can change the execute bits of a
> sealed hugetlbfs memfd.
> 
> Use memfd_check_seals_mode() in hugetlbfs_setattr() to reject changes
> to execute bits when F_SEAL_EXEC is set.
> 
> This also fixes the memfd_test hugetlbfs SEAL-EXEC subtest, where
> fchmod() incorrectly succeeded after applying F_SEAL_EXEC.
> 
> Fixes: 6fd7353829ca ("mm/memfd: add F_SEAL_EXEC")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Eva Kurchatova <eva.kurchatova@xxxxxxxxxxxxx>
> Link: https://patch.msgid.link/20260629180247.2343229-1-eva.kurchatova@xxxxxxxxxxxxx
> Acked-by: Pedro Falcato <pfalcato@xxxxxxx>
> Acked-by: Kiryl Shutsemau (Meta) <kas@xxxxxxxxxx>
> Acked-by: Zi Yan <ziy@xxxxxxxxxx>
> Tested-by: Gregory Price (Meta) <gourry@xxxxxxxxxx>
> Reviewed-by: Muchun Song <muchun.song@xxxxxxxxx>
> [ david: use common helper; fixup Fixes:; check only regular files ]
> Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>

Acked-by: Oscar Salvador <osalvador@xxxxxxx>

> ---
>  fs/hugetlbfs/inode.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
> index 01c4d6f44ebe..02e0a65d596d 100644
> --- a/fs/hugetlbfs/inode.c
> +++ b/fs/hugetlbfs/inode.c
> @@ -28,6 +28,7 @@
>  #include <linux/folio_batch.h>
>  #include <linux/fs_parser.h>
>  #include <linux/mman.h>
> +#include <linux/memfd.h>
>  #include <linux/slab.h>
>  #include <linux/dnotify.h>
>  #include <linux/statfs.h>
> @@ -840,6 +841,13 @@ static int hugetlbfs_setattr(const struct mnt_idmap *idmap,
>  	if (error)
>  		return error;
>  
> +	if (S_ISREG(inode->i_mode) && (ia_valid & ATTR_MODE)) {
> +		error = memfd_check_seals_mode(info->seals, inode->i_mode,
> +					       attr->ia_mode);
> +		if (error)
> +			return error;
> +	}
> +
>  	trace_hugetlbfs_setattr(inode, dentry, attr);
>  
>  	if (ia_valid & ATTR_SIZE) {
> 
> -- 
> 2.43.0
> 

-- 
Oscar Salvador
SUSE Labs