[PATCH] dma-buf: use SB_I_NOEXEC and SB_I_NODEV

[PATCH] dma-buf: use SB_I_NOEXEC and SB_I_NODEV

[Kees Cook]

The dma-buf pseudo-filesystem should never have executable mappings nor
device nodes. Set SB_I_NOEXEC and SB_I_NODEV on the superblock to enforce
this at the filesystem level, similar to secretmem, commit 98f99394a104
("secretmem: use SB_I_NOEXEC").

Fix the syzbot-reported warning from the exec code to enforce this
requirement:

> WARNING: CPU: 1 PID: 6000 at fs/exec.c:119 path_noexec+0x1af/0x200 fs/exec.c:118
> Modules linked in:
> CPU: 1 UID: 0 PID: 6000 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> RIP: 0010:path_noexec+0x1af/0x200 fs/exec.c:118
> Call Trace:
>  <TASK>
>  do_mmap+0xa43/0x10d0 mm/mmap.c:469
>  vm_mmap_pgoff+0x2a6/0x4d0 mm/util.c:580
>  ksys_mmap_pgoff+0x51f/0x760 mm/mmap.c:604
>  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>  do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported-by: syzbot+a9391462075ffb9f77c6@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68dc3ade.a70a0220.10c4b.015b.GAE@google.com/
Signed-off-by: Kees Cook <kees@kernel.org>
---
Cc: Christian Brauner <brauner@kernel.org>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: syzbot+a9391462075ffb9f77c6@syzkaller.appspotmail.com
Cc: <linux-media@vger.kernel.org>
Cc: <dri-devel@lists.freedesktop.org>
Cc: <linaro-mm-sig@lists.linaro.org>
---
 drivers/dma-buf/dma-buf.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 2bcf9ceca997..6e2ab1a4560d 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -189,6 +189,8 @@ static int dma_buf_fs_init_context(struct fs_context *fc)
 {
 	struct pseudo_fs_context *ctx;
 
+	fc->s_iflags |= SB_I_NOEXEC;
+	fc->s_iflags |= SB_I_NODEV;
 	ctx = init_pseudo(fc, DMA_BUF_MAGIC);
 	if (!ctx)
 		return -ENOMEM;
-- 
2.34.1

Re: [PATCH] dma-buf: use SB_I_NOEXEC and SB_I_NODEV

[Kees Cook]

On Tue, Oct 07, 2025 at 11:16:05PM -0700, Christoph Hellwig wrote:
> On Tue, Oct 07, 2025 at 11:10:32PM -0700, Kees Cook wrote:
> > The dma-buf pseudo-filesystem should never have executable mappings nor
> > device nodes. Set SB_I_NOEXEC and SB_I_NODEV on the superblock to enforce
> > this at the filesystem level, similar to secretmem, commit 98f99394a104
> > ("secretmem: use SB_I_NOEXEC").
> > 
> > Fix the syzbot-reported warning from the exec code to enforce this
> > requirement:
> 
> Can you please just enforce this in init_pseudo?  If a file system
> really wants to support devices or executable it can clear them,
> but a quick grep suggests that none of them should.

I that that's a fine idea, but I defer to Christian -- I think the WARN
was put in place to avoid doing that...

-- 
Kees Cook