Re: [PATCH stable 5.15 v3] lib/buildid: Handle memfd_secret() files in build_id_parse()

Jiri Olsa
2025-03-17T10:18:20Z

On Mon, Mar 17, 2025 at 01:21:32PM +0800, Chen Linxuan wrote:
> [ Upstream commit 5ac9b4e935dfc6af41eee2ddc21deb5c36507a9f ]
>
> >From memfd_secret(2) manpage:
>
> The memory areas backing the file created with memfd_secret(2) are
> visible only to the processes that have access to the file descriptor.
> The memory region is removed from the kernel page tables and only the
> page tables of the processes holding the file descriptor map the
> corresponding physical memory. (Thus, the pages in the region can't be
> accessed by the kernel itself, so that, for example, pointers to the
> region can't be passed to system calls.)
>
> We need to handle this special case gracefully in build ID fetching
> code. Return -EFAULT whenever secretmem file is passed to build_id_parse()
> family of APIs. Original report and repro can be found in [0].
>
> [0] https://lore.kernel.org/bpf/ZwyG8Uro%2FSyTXAni@ly-workstation/
>
> Fixes: de3ec364c3c3 ("lib/buildid: add single folio-based file reader abstraction")
> Reported-by: Yi Lai <yi1.lai@intel.com>
> Suggested-by: Shakeel Butt <shakeel.butt@linux.dev>
> Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
> Link: https://lore.kernel.org/bpf/20241017175431.6183-A-hca@linux.ibm.com
> Link: https://lore.kernel.org/bpf/20241017174713.2157873-1-andrii@kernel.org
> [ Chen Linxuan: backport same logic without folio-based changes ]
> Cc: stable@vger.kernel.org
> Fixes: 88a16a130933 ("perf: Add build id data in mmap2 event")
> Signed-off-by: Chen Linxuan <chenlinxuan@deepin.org>

lgtm

Reviewed-by: Jiri Olsa <jolsa@kernel.org>

jirka

> ---
> v1 -> v2: use vma_is_secretmem() instead of directly checking
> vma->vm_file->f_op == &secretmem_fops
> v2 -> v3: keep original comment
> ---
> lib/buildid.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/lib/buildid.c b/lib/buildid.c
> index 9fc46366597e..8d839ff5548e 100644
> --- a/lib/buildid.c
> +++ b/lib/buildid.c
> @@ -5,6 +5,7 @@
> #include <linux/elf.h>
> #include <linux/kernel.h>
> #include <linux/pagemap.h>
> +#include <linux/secretmem.h>
>
> #define BUILD_ID 3
>
> @@ -157,6 +158,10 @@ int build_id_parse(struct vm_area_struct *vma, unsigned char *build_id,
> if (!vma->vm_file)
> return -EINVAL;
>
> + /* reject secretmem folios created with memfd_secret() */
> + if (vma_is_secretmem(vma))
> + return -EFAULT;
> +
> page = find_get_page(vma->vm_file->f_mapping, 0);
> if (!page)
> return -EFAULT; /* page not mapped */
> --
> 2.48.1
>
>