Re: [PATCH] hugetlbfs: enforce F_SEAL_EXEC on chmod

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] hugetlbfs: uninitialized info->seals read in hugetlbfs_setattr() on root dir
--

commit 42d3d553628462e4f19c0be00708f922ba1aa705
Author: Samiullah Khawaja <skhawaja@google.com>

hugetlbfs: enforce F_SEAL_EXEC on chmod

This commit adds a check for F_SEAL_EXEC to hugetlbfs_setattr() so that mode
changes modifying execute bits on sealed hugetlbfs memfds fail with -EPERM.

> diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
> index 01c4d6f44ebe0..56e0588d295d9 100644
> --- a/fs/hugetlbfs/inode.c
> +++ b/fs/hugetlbfs/inode.c
> @@ -842,6 +842,10 @@ static int hugetlbfs_setattr(const struct mnt_idmap *idmap,
>  
>  	trace_hugetlbfs_setattr(inode, dentry, attr);
>  
> +	if ((info->seals & F_SEAL_EXEC) && (ia_valid & ATTR_MODE) &&
> +	    ((inode->i_mode ^ attr->ia_mode) & 0111))
> +		return -EPERM;

[Severity: High]
Could this read uninitialized memory from info->seals when setattr is called
on a hugetlbfs mount root directory?

hugetlbfs_setattr() is also used as the .setattr callback in
hugetlbfs_dir_inode_operations. While inodes created via
hugetlbfs_get_inode() initialize info->seals to F_SEAL_SEAL, the root
directory inode allocated in hugetlbfs_get_root() does not initialize seals:

fs/hugetlbfs/inode.c:hugetlbfs_get_root() {
	inode = new_inode(sb);
	if (inode) {
		inode->i_ino = get_next_ino();
		inode->i_mode = S_IFDIR | ctx->mode;
		inode->i_uid = ctx->uid;
		inode->i_gid = ctx->gid;
		simple_inode_init_ts(inode);
		inode->i_op = &hugetlbfs_dir_inode_operations;
		inode->i_fop = &simple_dir_operations;
		HUGETLBFS_I(inode)->resv_map = NULL;
...
}

Because new_inode() -> hugetlbfs_alloc_inode() allocates from
hugetlbfs_inode_cachep without __GFP_ZERO, and the slab constructor
init_once() only calls inode_init_once(&ei->vfs_inode), HUGETLBFS_I(inode)->seals
is left uninitialized on fresh slab allocations and retains stale values when
a slab object is recycled from a previously closed hugetlbfs memfd.

Previously, hugetlbfs_setattr() only checked info->seals inside the
ATTR_SIZE block, which was unreachable for directories. With this check placed
outside ATTR_SIZE, any chmod, chown, or utimensat on the root directory of a
hugetlbfs mount reads uninitialized or stale info->seals, and chmod changing
any 0111 bit on the root directory can spuriously fail with -EPERM if the
slab object previously belonged to a memfd with F_SEAL_EXEC set.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261026205555.2918396-1-skhawaja@google.com?part=1