From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794585550; b=UfRv2ZIIVla1ZMT/pwtUO9JnhixrLnTsLIgOXWARDQctGwtvRFap8p4FPZONvqh9puVo alLfWU1rrEpVgj4rV0J60C7y2wzoHPW8S0VH1QkBU8gzBi0CIBmHThUjqu3VOAxlFJ3Z6 2bThLED2AD2z4gpYlEgWnil9lLU/nS60zGNVaO2N97b1JyMBRfT48+9FWW5dVE2Cy4JX/ MsuBF21f1HqVemHN1eMC/3eGg49DPHiFJoJe9/AYQGswT4RgDPWf2gwtlNBIOuviphKcl AYR6xHV15u12uBucA70wWLbJepEZyW7ykwKG/wCaeVBOCOgOY7MT8kjNEsc19sDjLZg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794585550; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=2/ed1CBjwOgzMkALmmBxYkwJZlOOR/bXTgSEmEpcoYo=; b=gUO6ZOYZzrXONfYBpn8/mnYovxJ99wa2TNEpaB5p9lsThWYFyyXaVOccxxS+JIljSpBb Q28vphFcs0rbwe9qVadHgf4AsP5YmjFoxTIS46+6jVGsq+P+7RxC00DnTckL4INtcF1OI K3X2zi5lpdrM8plvZICocYy0QlmYCI2uVpusTOHctOlCIJh7JRldtMIVBjf0VKYazN+Va Yv/ugdW3AtYSwKjYNyjtxzW/rw3NynJVzQsoYXV3NnzypL+8CxNJV3gZw+cu8VCQcOPf5 GLlpEIhhkgMjBdRKh89Rf1l4TUp+rYcfGmwPOGOOYuJRJV1e0YNQNHubhabtDu0YgRw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=LHLYTv0Y; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD5A5606BA80; Fri, 13 Nov 2026 15:59:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=LHLYTv0Y Received: by smtp.kernel.org (Postfix) with ESMTPSA id 69AB01F000C6; Fri, 13 Nov 2026 15:59:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794585550; bh=2/ed1CBjwOgzMkALmmBxYkwJZlOOR/bXTgSEmEpcoYo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=LHLYTv0YKK0L5fW7ObUnnTOhGkNy61VzsSUmfRHoee0ZeH59k9Bp2j31OQ79E/Dj9 5SF/pr0f2n4yfEOC+EfoezUINXh0s92HatkVwpzNo1KuGaOdbclkl64U4n8IYn6+A/ CzoIUuezI15a4DSpM6Nr1bBWU3CvZEE9VF+L/YtQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Chris Mason , Pratyush Yadav , Baolin Wang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 7.3 147/507] mm/shmem: make shmem_file() check the files inode Date: Fri, 13 Nov 2026 10:47:31 -0500 Message-ID: <20261113153759.413901241@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153753.358973689@linuxfoundation.org> References: <20261113153753.358973689@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: David Hildenbrand (Arm) [ Upstream commit d3710111839d11339e414b1bb3fea3d05ab83f6e ] shmem_file() only checks if file->f_mapping is a shmem mapping. This mapping can belong to another file, however, as with a Coda file backed by a tmpfs container after mmap(). So it does not guarantee that the file inode is an actual shmem inode. Seal handling and memfd preservation use this check before accessing shmem inode state, so they can access an inode of the wrong type. Let's make shmem_file() check the inode's file operations instead, to identify shmem inodes reliably. This will identify regular shmem inodes, including memfds and ordinary tmpfs files, independently of wrapper file operations. Use shmem_mapping() in collapse_file() instead to not change the behavior of collapse_file(): it operates on the page cache and uses mapping->host for shmem inode operations. Focusing on the file does not seem relevant. Fixes: c49fcfcda8b5 ("mm/shmem: update file sealing comments and file checking") Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd") Cc: stable@vger.kernel.org Reported-by: Chris Mason Suggested-by: Pratyush Yadav Reviewed-by: Pratyush Yadav (Google) Link: https://patch.msgid.link/20261031-fixes_core-v3-3-d6437171ecc3@kernel.org Reviewed-by: Baolin Wang Signed-off-by: David Hildenbrand (Arm) Signed-off-by: Sasha Levin --- include/linux/shmem_fs.h | 15 ++++++--------- mm/khugepaged.c | 2 +- mm/shmem.c | 5 +++++ 3 files changed, 12 insertions(+), 10 deletions(-) diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h index 5663dff53186e..842cc0f961470 100644 --- a/include/linux/shmem_fs.h +++ b/include/linux/shmem_fs.h @@ -111,8 +111,14 @@ extern unsigned long shmem_get_unmapped_area(struct file *, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags); extern int shmem_lock(struct file *file, int lock, struct ucounts *ucounts); #ifdef CONFIG_SHMEM +bool shmem_file(struct file *file); bool shmem_mapping(const struct address_space *mapping); #else +static inline bool shmem_file(struct file *file) +{ + return false; +} + static inline bool shmem_mapping(const struct address_space *mapping) { return false; @@ -187,15 +193,6 @@ static inline struct page *shmem_read_mapping_page( mapping_gfp_mask(mapping)); } -static inline bool shmem_file(struct file *file) -{ - if (!IS_ENABLED(CONFIG_SHMEM)) - return false; - if (!file || !file->f_mapping) - return false; - return shmem_mapping(file->f_mapping); -} - /* Must be called with inode lock taken exclusive. */ static inline void shmem_freeze(struct inode *inode, bool freeze) { diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 792166950bba8..b717de08e3c8b 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -2251,6 +2251,7 @@ static enum scan_result collapse_file(struct mm_struct *mm, unsigned long addr, struct file *file, pgoff_t start, struct collapse_control *cc) { struct address_space *mapping = file->f_mapping; + const bool is_shmem = shmem_mapping(mapping); struct page *dst; struct folio *folio, *tmp, *new_folio; unsigned long new_pfn = -1; @@ -2259,7 +2260,6 @@ static enum scan_result collapse_file(struct mm_struct *mm, unsigned long addr, XA_STATE_ORDER(xas, &mapping->i_pages, start, HPAGE_PMD_ORDER); enum scan_result result = SCAN_SUCCEED; int nr_none = 0; - bool is_shmem = shmem_file(file); /* * MADV_COLLAPSE ignores shmem huge config, so do not check shmem diff --git a/mm/shmem.c b/mm/shmem.c index 199e8a9c2a2b4..edda9f90b3d89 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -275,6 +275,11 @@ static const struct vm_operations_struct shmem_vm_ops; static const struct vm_operations_struct shmem_anon_vm_ops; static struct file_system_type shmem_fs_type; +bool shmem_file(struct file *file) +{ + return file && file_inode(file)->i_fop == &shmem_file_operations; +} + bool shmem_mapping(const struct address_space *mapping) { return mapping->a_ops == &shmem_aops; -- 2.53.0