Re: [PATCH v2] debugfs: Fix lockdown check for mmap_prepare

[joeyli <jlee@suse.com>]

Hi Disha,

On Fri, Jun 19, 2026 at 04:41:57PM +0530, Disha Goel wrote:
> On 15/06/26 4:17 pm, Chun-Yi Lee wrote:
> > From: Chun-Yi Lee <jlee@suse.com>
> > 
> > Commit 651fdda8406d ("relay: update relay to use mmap_prepare")
> > changed the `mmap` file operation to `mmap_prepare` for relayfs, but
> > the lockdown check in debugfs was not updated accordingly.
> > 
> > This prevents debugfs from being locked down when the kernel is in
> > integrity mode if a file uses `mmap_prepare` but not `mmap`.
> > 
> > Since the conversion to `mmap_prepare` across the kernel is not yet
> > complete, update the lockdown check to look for both `mmap` and
> > `mmap_prepare` to ensure comprehensive coverage.
> > 
> > Fixes: 651fdda8406d ("relay: update relay to use mmap_prepare")
> > Signed-off-by: Chun-Yi Lee <jlee@suse.com>
> > Cc: David Howells <dhowells@redhat.com>
> > Cc: Lorenzo Stoakes <ljs@kernel.org>
> > Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
> > Cc: Thomas Gleixner <tglx@linutronix.de>
> > Cc: Rafael J. Wysocki <rafael@kernel.org>
> > Cc: Matthew Garrett <mjg59@srcf.ucam.org>
> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > Cc: Danilo Krummrich <dakr@kernel.org>
> > Cc: driver-core@lists.linux.dev
> > Cc: linux-kernel@vger.kernel.org
> > Cc: stable@vger.kernel.org
> > ---
> 
> Hi,
> 
> I tested this patch on ppc64le with lockdown enabled. It correctly fixes the
> security issue where debugfs files using mmap_prepare were not being
> restricted.
> 
> Test: blktrace/001 from blktests (uses relayfs via debugfs)
> - Before patch: blktrace bypassed lockdown and accessed debugfs
> - After patch: blktrace properly blocked from accessing debugfs
> 
> Environment:
> Kernel: 7.1.0-rc7
> Lockdown: integrity mode
> 
> Feel free to add:
> Tested-by: Disha Goel <disgoel@linux.ibm.com>
> 

Thanks for your testing!

Joey Lee