[PATCH] hugetlbfs: enforce F_SEAL_EXEC on chmod

[PATCH] hugetlbfs: enforce F_SEAL_EXEC on chmod

[Samiullah Khawaja]

F_SEAL_EXEC prevents the exec bits of a memfd from being changed once
the seal has been set. F_SEAL_EXEC is included in F_ALL_SEALS, so
userspace can set it with F_ADD_SEALS on hugetlbfs memfds just like on
shmem memfds, and F_GET_SEALS then reports it as set. However, the check
that rejects the mode change was only added to shmem_setattr().
hugetlbfs_setattr() never looks at the seal, so the owner of a sealed
hugetlbfs memfd can still make it executable with chmod(). For the same
reason, MFD_NOEXEC_SEAL provides no guarantee when it is combined with
MFD_HUGETLB.

The memfd selftest already covers this, but only the shmem run passes.
When run as "memfd_test hugetlbfs", the test aborts in SEAL-EXEC because
fchmod() succeeds on a sealed file, and none of the remaining tests are
executed.

Add the same check to hugetlbfs_setattr() that shmem_setattr() has, so
that a mode change touching the exec bits fails with -EPERM while
F_SEAL_EXEC is set.

Fixes: 6fd7353829ca ("mm/memfd: add F_SEAL_EXEC")
Cc: stable@vger.kernel.org
Signed-off-by: Samiullah Khawaja <skhawaja@google.com>
---
 fs/hugetlbfs/inode.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 01c4d6f44ebe..56e0588d295d 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -842,6 +842,10 @@ static int hugetlbfs_setattr(const struct mnt_idmap *idmap,
 
 	trace_hugetlbfs_setattr(inode, dentry, attr);
 
+	if ((info->seals & F_SEAL_EXEC) && (ia_valid & ATTR_MODE) &&
+	    ((inode->i_mode ^ attr->ia_mode) & 0111))
+		return -EPERM;
+
 	if (ia_valid & ATTR_SIZE) {
 		loff_t oldsize = inode->i_size;
 		loff_t newsize = attr->ia_size;

base-commit: f1ac44c32cba88ad65dcecd4a279661d14e93651
-- 
2.56.0.307.g5fe7bd680c-goog

Re: [PATCH] hugetlbfs: enforce F_SEAL_EXEC on chmod

[David Hildenbrand (Arm)]

On 10/26/26 21:55, Samiullah Khawaja wrote:
> F_SEAL_EXEC prevents the exec bits of a memfd from being changed once
> the seal has been set. F_SEAL_EXEC is included in F_ALL_SEALS, so
> userspace can set it with F_ADD_SEALS on hugetlbfs memfds just like on
> shmem memfds, and F_GET_SEALS then reports it as set. However, the check
> that rejects the mode change was only added to shmem_setattr().
> hugetlbfs_setattr() never looks at the seal, so the owner of a sealed
> hugetlbfs memfd can still make it executable with chmod(). For the same
> reason, MFD_NOEXEC_SEAL provides no guarantee when it is combined with
> MFD_HUGETLB.
> 
> The memfd selftest already covers this, but only the shmem run passes.
> When run as "memfd_test hugetlbfs", the test aborts in SEAL-EXEC because
> fchmod() succeeds on a sealed file, and none of the remaining tests are
> executed.
> 
> Add the same check to hugetlbfs_setattr() that shmem_setattr() has, so
> that a mode change touching the exec bits fails with -EPERM while
> F_SEAL_EXEC is set.
> 
> Fixes: 6fd7353829ca ("mm/memfd: add F_SEAL_EXEC")
> Cc: stable@vger.kernel.org
> Signed-off-by: Samiullah Khawaja <skhawaja@google.com>
> ---
>  fs/hugetlbfs/inode.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
> index 01c4d6f44ebe..56e0588d295d 100644
> --- a/fs/hugetlbfs/inode.c
> +++ b/fs/hugetlbfs/inode.c
> @@ -842,6 +842,10 @@ static int hugetlbfs_setattr(const struct mnt_idmap *idmap,
>  
>  	trace_hugetlbfs_setattr(inode, dentry, attr);
>  
> +	if ((info->seals & F_SEAL_EXEC) && (ia_valid & ATTR_MODE) &&
> +	    ((inode->i_mode ^ attr->ia_mode) & 0111))
> +		return -EPERM;
> +
>  	if (ia_valid & ATTR_SIZE) {
>  		loff_t oldsize = inode->i_size;
>  		loff_t newsize = attr->ia_size;
> 
> base-commit: f1ac44c32cba88ad65dcecd4a279661d14e93651

https://lore.kernel.org/r/20261026-fixes_shmem-v1-5-703206d5fa0c@kernel.org

-- 
Cheers,

David

Re: [PATCH] hugetlbfs: enforce F_SEAL_EXEC on chmod

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] hugetlbfs: uninitialized info->seals read in hugetlbfs_setattr() on root dir
--

commit 42d3d553628462e4f19c0be00708f922ba1aa705
Author: Samiullah Khawaja <skhawaja@google.com>

hugetlbfs: enforce F_SEAL_EXEC on chmod

This commit adds a check for F_SEAL_EXEC to hugetlbfs_setattr() so that mode
changes modifying execute bits on sealed hugetlbfs memfds fail with -EPERM.

> diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
> index 01c4d6f44ebe0..56e0588d295d9 100644
> --- a/fs/hugetlbfs/inode.c
> +++ b/fs/hugetlbfs/inode.c
> @@ -842,6 +842,10 @@ static int hugetlbfs_setattr(const struct mnt_idmap *idmap,
>  
>  	trace_hugetlbfs_setattr(inode, dentry, attr);
>  
> +	if ((info->seals & F_SEAL_EXEC) && (ia_valid & ATTR_MODE) &&
> +	    ((inode->i_mode ^ attr->ia_mode) & 0111))
> +		return -EPERM;

[Severity: High]
Could this read uninitialized memory from info->seals when setattr is called
on a hugetlbfs mount root directory?

hugetlbfs_setattr() is also used as the .setattr callback in
hugetlbfs_dir_inode_operations. While inodes created via
hugetlbfs_get_inode() initialize info->seals to F_SEAL_SEAL, the root
directory inode allocated in hugetlbfs_get_root() does not initialize seals:

fs/hugetlbfs/inode.c:hugetlbfs_get_root() {
	inode = new_inode(sb);
	if (inode) {
		inode->i_ino = get_next_ino();
		inode->i_mode = S_IFDIR | ctx->mode;
		inode->i_uid = ctx->uid;
		inode->i_gid = ctx->gid;
		simple_inode_init_ts(inode);
		inode->i_op = &hugetlbfs_dir_inode_operations;
		inode->i_fop = &simple_dir_operations;
		HUGETLBFS_I(inode)->resv_map = NULL;
...
}

Because new_inode() -> hugetlbfs_alloc_inode() allocates from
hugetlbfs_inode_cachep without __GFP_ZERO, and the slab constructor
init_once() only calls inode_init_once(&ei->vfs_inode), HUGETLBFS_I(inode)->seals
is left uninitialized on fresh slab allocations and retains stale values when
a slab object is recycled from a previously closed hugetlbfs memfd.

Previously, hugetlbfs_setattr() only checked info->seals inside the
ATTR_SIZE block, which was unreachable for directories. With this check placed
outside ATTR_SIZE, any chmod, chown, or utimensat on the root directory of a
hugetlbfs mount reads uninitialized or stale info->seals, and chmod changing
any 0111 bit on the root directory can spuriously fail with -EPERM if the
slab object previously belonged to a memfd with F_SEAL_EXEC set.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261026205555.2918396-1-skhawaja@google.com?part=1