Re: [PATCH v2 09/10] mm/shmem_luo: Allow retrieving tmpfs files with O_RDONLY

[David Matlack <dmatlack@google.com>]

On 2026-10-23 10:51 PM, sashiko-bot@kernel.org wrote:

> > +	ro_file = dentry_open(&file->f_path, flags, current_cred());
> > +	fput(file);
> > +	return ro_file;
> >  }
> >  
> >  static int shmem_luo_retrieve(struct liveupdate_file_op_args *args)
> 
> [Severity: Medium]
> When userspace retrieves a tmpfs file via LIVEUPDATE_SESSION_RETRIEVE_FD with
> O_RDONLY in arg->flags, does passing the raw flags variable to dentry_open()
> in shmem_luo_create_tmpfs_file() in mm/shmem_luo.c bypass the flag
> normalization performed by file_open_root() -> build_open_flags()?
> 
> In fs/open.c, build_open_flags() strips O_CLOEXEC and ensures O_DSYNC is set
> when __O_SYNC is present:
> 
>     u64 flags = how->flags;
>     u64 strip = O_CLOEXEC;
>     ...
>     flags &= ~strip;
>     ...
>     if (flags & __O_SYNC)
>         flags |= O_DSYNC;
> 
> Because dentry_open() -> alloc_empty_file() -> init_file() initializes
> ro_file->f_flags directly from the passed flags and do_dentry_open() only
> clears:
> 
>     f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC | __O_REGULAR);
>     f->f_iocb_flags = iocb_flags(f);
> 
> passing O_RDONLY | O_CLOEXEC in arg->flags leaves O_CLOEXEC in
> ro_file->f_flags (visible via fcntl(fd, F_GETFL) and /proc/<pid>/fdinfo/<fd>),
> and passing O_RDONLY | __O_SYNC without O_DSYNC leaves O_DSYNC and IOCB_DSYNC
> unset on ro_file.
> 
> Should dentry_open() be passed (file->f_flags & ~O_ACCMODE) | O_RDONLY instead
> of flags so that ro_file uses the normalized flags from file?

Yes. I will fix this in v3 to re-open the read-only file with the flags
that file_open_root() already normalized.