mm: call the security_mmap_file() LSM hook in remap_file_pages()

["yao.zhang1@amlogic.com" <yao.zhang1@amlogic.com>]

Dear 5.15.y maintainers,



An mm patch should be backported from upstream mainline to the stable
5.15.y branch. The patch's information is shown as below:


[Subject]
mm: call the security_mmap_file() LSM hook in remap_file_pages()


[Upstream commit ID]
0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1

[Kernel version]
5.15.y


[Why]
The remap_file_pages syscall handler calls do_mmap() directly, which
doesn't contain the LSM security check. And if the process has called
personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for
RW pages, this will actually result in remapping the pages to RWX,
bypassing a W^X policy enforced by SELinux.
So we should check prot by security_mmap_file LSM hook in the
remap_file_pages syscall handler before do_mmap() is called. Otherwise, it
potentially permits an attacker to bypass a W^X policy enforced by
SELinux.



Thanks,
yao.zhang1