[PATCH 5.10.y 0/4] Backport series: "permit write-sealed memfd read-only shared mappings"

[PATCH 5.10.y 0/4] Backport series: "permit write-sealed memfd read-only shared mappings"

[Isaac J. Manjarres]

Hello,

Until kernel version 6.7, a write-sealed memfd could not be mapped as
shared and read-only. This was clearly a bug, and was not inline with
the description of F_SEAL_WRITE in the man page for fcntl()[1].

Lorenzo's series [2] fixed that issue and was merged in kernel version
6.7, but was not backported to older kernels. So, this issue is still
present on kernels 5.4, 5.10, 5.15, 6.1, and 6.6.

This series consists of backports of two of Lorenzo's series [2] and
[3].

Note: for [2], I dropped the last patch in that series, since it
wouldn't make sense to apply it due to [4] being part of this tree. In
lieu of that, I backported [3] to ultimately allow write-sealed memfds
to be mapped as read-only.

[1] https://man7.org/linux/man-pages/man2/fcntl.2.html
[2] https://lore.kernel.org/all/913628168ce6cce77df7d13a63970bae06a526e0.1697116581.git.lstoakes@gmail.com/T/#m28fbfb0d5727e5693e54a7fb2e0c9ac30e95eca5
[3] https://lkml.kernel.org/r/99fc35d2c62bd2e05571cf60d9f8b843c56069e0.1732804776.git.lorenzo.stoakes@oracle.com
[4] https://lore.kernel.org/all/6e0becb36d2f5472053ac5d544c0edfe9b899e25.1730224667.git.lorenzo.stoakes@oracle.com/T/#u

Lorenzo Stoakes (4):
  mm: drop the assumption that VM_SHARED always implies writable
  mm: update memfd seal write check to include F_SEAL_WRITE
  mm: reinstate ability to map write-sealed memfd mappings read-only
  selftests/memfd: add test for mapping write-sealed memfd read-only

 fs/hugetlbfs/inode.c                       |  2 +-
 include/linux/fs.h                         |  4 +-
 include/linux/memfd.h                      | 14 ++++
 include/linux/mm.h                         | 80 +++++++++++++++-------
 kernel/fork.c                              |  2 +-
 mm/filemap.c                               |  2 +-
 mm/madvise.c                               |  2 +-
 mm/memfd.c                                 |  2 +-
 mm/mmap.c                                  | 10 ++-
 mm/shmem.c                                 |  2 +-
 tools/testing/selftests/memfd/memfd_test.c | 43 ++++++++++++
 11 files changed, 129 insertions(+), 34 deletions(-)

-- 
2.50.1.552.g942d659e1b-goog

[PATCH 5.10.y 1/4] mm: drop the assumption that VM_SHARED always implies writable

[Isaac J. Manjarres]

From: Lorenzo Stoakes <lstoakes@gmail.com>

[ Upstream commit e8e17ee90eaf650c855adb0a3e5e965fd6692ff1 ]

Patch series "permit write-sealed memfd read-only shared mappings", v4.

The man page for fcntl() describing memfd file seals states the following
about F_SEAL_WRITE:-

    Furthermore, trying to create new shared, writable memory-mappings via
    mmap(2) will also fail with EPERM.

With emphasis on 'writable'.  In turns out in fact that currently the
kernel simply disallows all new shared memory mappings for a memfd with
F_SEAL_WRITE applied, rendering this documentation inaccurate.

This matters because users are therefore unable to obtain a shared mapping
to a memfd after write sealing altogether, which limits their usefulness.
This was reported in the discussion thread [1] originating from a bug
report [2].

This is a product of both using the struct address_space->i_mmap_writable
atomic counter to determine whether writing may be permitted, and the
kernel adjusting this counter when any VM_SHARED mapping is performed and
more generally implicitly assuming VM_SHARED implies writable.

It seems sensible that we should only update this mapping if VM_MAYWRITE
is specified, i.e.  whether it is possible that this mapping could at any
point be written to.

If we do so then all we need to do to permit write seals to function as
documented is to clear VM_MAYWRITE when mapping read-only.  It turns out
this functionality already exists for F_SEAL_FUTURE_WRITE - we can
therefore simply adapt this logic to do the same for F_SEAL_WRITE.

We then hit a chicken and egg situation in mmap_region() where the check
for VM_MAYWRITE occurs before we are able to clear this flag.  To work
around this, perform this check after we invoke call_mmap(), with careful
consideration of error paths.

Thanks to Andy Lutomirski for the suggestion!

[1]:https://lore.kernel.org/all/20230324133646.16101dfa666f253c4715d965@linux-foundation.org/
[2]:https://bugzilla.kernel.org/show_bug.cgi?id=217238

This patch (of 3):

There is a general assumption that VMAs with the VM_SHARED flag set are
writable.  If the VM_MAYWRITE flag is not set, then this is simply not the
case.

Update those checks which affect the struct address_space->i_mmap_writable
field to explicitly test for this by introducing
[vma_]is_shared_maywrite() helper functions.

This remains entirely conservative, as the lack of VM_MAYWRITE guarantees
that the VMA cannot be written to.

Link: https://lkml.kernel.org/r/cover.1697116581.git.lstoakes@gmail.com
Link: https://lkml.kernel.org/r/d978aefefa83ec42d18dfa964ad180dbcde34795.1697116581.git.lstoakes@gmail.com
Signed-off-by: Lorenzo Stoakes <lstoakes@gmail.com>
Suggested-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Muchun Song <muchun.song@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: stable@vger.kernel.org
[isaacmanjarres: resolved merge conflicts due to
due to refactoring that happened in upstream commit
5de195060b2e ("mm: resolve faulty mmap_region() error path behaviour")]
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
---
 include/linux/fs.h |  4 ++--
 include/linux/mm.h | 11 +++++++++++
 kernel/fork.c      |  2 +-
 mm/filemap.c       |  2 +-
 mm/madvise.c       |  2 +-
 mm/mmap.c          |  6 +++---
 6 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 9463dddce6bf..11294a89a53b 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -436,7 +436,7 @@ int pagecache_write_end(struct file *, struct address_space *mapping,
  * @host: Owner, either the inode or the block_device.
  * @i_pages: Cached pages.
  * @gfp_mask: Memory allocation flags to use for allocating pages.
- * @i_mmap_writable: Number of VM_SHARED mappings.
+ * @i_mmap_writable: Number of VM_SHARED, VM_MAYWRITE mappings.
  * @nr_thps: Number of THPs in the pagecache (non-shmem only).
  * @i_mmap: Tree of private and shared mappings.
  * @i_mmap_rwsem: Protects @i_mmap and @i_mmap_writable.
@@ -535,7 +535,7 @@ static inline int mapping_mapped(struct address_space *mapping)
 
 /*
  * Might pages of this file have been modified in userspace?
- * Note that i_mmap_writable counts all VM_SHARED vmas: do_mmap
+ * Note that i_mmap_writable counts all VM_SHARED, VM_MAYWRITE vmas: do_mmap
  * marks vma as VM_SHARED if it is shared, and the file was opened for
  * writing i.e. vma may be mprotected writable even if now readonly.
  *
diff --git a/include/linux/mm.h b/include/linux/mm.h
index e159a11424f1..2bedc9940c47 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -666,6 +666,17 @@ static inline bool vma_is_accessible(struct vm_area_struct *vma)
 	return vma->vm_flags & VM_ACCESS_FLAGS;
 }
 
+static inline bool is_shared_maywrite(vm_flags_t vm_flags)
+{
+	return (vm_flags & (VM_SHARED | VM_MAYWRITE)) ==
+		(VM_SHARED | VM_MAYWRITE);
+}
+
+static inline bool vma_is_shared_maywrite(struct vm_area_struct *vma)
+{
+	return is_shared_maywrite(vma->vm_flags);
+}
+
 #ifdef CONFIG_SHMEM
 /*
  * The vma_is_shmem is not inline because it is used only by slow
diff --git a/kernel/fork.c b/kernel/fork.c
index 6ece27056fe9..cdf28ac44879 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -561,7 +561,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm,
 			if (tmp->vm_flags & VM_DENYWRITE)
 				put_write_access(inode);
 			i_mmap_lock_write(mapping);
-			if (tmp->vm_flags & VM_SHARED)
+			if (vma_is_shared_maywrite(tmp))
 				mapping_allow_writable(mapping);
 			flush_dcache_mmap_lock(mapping);
 			/* insert tmp into the share list, just after mpnt */
diff --git a/mm/filemap.c b/mm/filemap.c
index 3b0d8c6dd587..b98af5680bb9 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2959,7 +2959,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
  */
 int generic_file_readonly_mmap(struct file *file, struct vm_area_struct *vma)
 {
-	if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE))
+	if (vma_is_shared_maywrite(vma))
 		return -EINVAL;
 	return generic_file_mmap(file, vma);
 }
diff --git a/mm/madvise.c b/mm/madvise.c
index a63aa04ec7fa..370d0ef719eb 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -848,7 +848,7 @@ static long madvise_remove(struct vm_area_struct *vma,
 			return -EINVAL;
 	}
 
-	if ((vma->vm_flags & (VM_SHARED|VM_WRITE)) != (VM_SHARED|VM_WRITE))
+	if (!vma_is_shared_maywrite(vma))
 		return -EACCES;
 
 	offset = (loff_t)(start - vma->vm_start)
diff --git a/mm/mmap.c b/mm/mmap.c
index 8c188ed3738a..3cc0d56e41ad 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -144,7 +144,7 @@ static void __remove_shared_vm_struct(struct vm_area_struct *vma,
 {
 	if (vma->vm_flags & VM_DENYWRITE)
 		allow_write_access(file);
-	if (vma->vm_flags & VM_SHARED)
+	if (vma_is_shared_maywrite(vma))
 		mapping_unmap_writable(mapping);
 
 	flush_dcache_mmap_lock(mapping);
@@ -663,7 +663,7 @@ static void __vma_link_file(struct vm_area_struct *vma)
 
 		if (vma->vm_flags & VM_DENYWRITE)
 			put_write_access(file_inode(file));
-		if (vma->vm_flags & VM_SHARED)
+		if (vma_is_shared_maywrite(vma))
 			mapping_allow_writable(mapping);
 
 		flush_dcache_mmap_lock(mapping);
@@ -2942,7 +2942,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
 		return -EINVAL;
 
 	/* Map writable and ensure this isn't a sealed memfd. */
-	if (file && (vm_flags & VM_SHARED)) {
+	if (file && is_shared_maywrite(vm_flags)) {
 		int error = mapping_map_writable(file->f_mapping);
 
 		if (error)
-- 
2.50.1.552.g942d659e1b-goog

[PATCH 5.10.y 2/4] mm: update memfd seal write check to include F_SEAL_WRITE

[Isaac J. Manjarres]

From: Lorenzo Stoakes <lstoakes@gmail.com>

[ Upstream commit 28464bbb2ddc199433383994bcb9600c8034afa1 ]

The seal_check_future_write() function is called by shmem_mmap() or
hugetlbfs_file_mmap() to disallow any future writable mappings of an memfd
sealed this way.

The F_SEAL_WRITE flag is not checked here, as that is handled via the
mapping->i_mmap_writable mechanism and so any attempt at a mapping would
fail before this could be run.

However we intend to change this, meaning this check can be performed for
F_SEAL_WRITE mappings also.

The logic here is equally applicable to both flags, so update this
function to accommodate both and rename it accordingly.

Link: https://lkml.kernel.org/r/913628168ce6cce77df7d13a63970bae06a526e0.1697116581.git.lstoakes@gmail.com
Signed-off-by: Lorenzo Stoakes <lstoakes@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Muchun Song <muchun.song@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: stable@vger.kernel.org
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
---
 fs/hugetlbfs/inode.c |  2 +-
 include/linux/mm.h   | 15 ++++++++-------
 mm/shmem.c           |  2 +-
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index bf3cda498962..6e97a54ffda1 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -148,7 +148,7 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
 	vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND;
 	vma->vm_ops = &hugetlb_vm_ops;
 
-	ret = seal_check_future_write(info->seals, vma);
+	ret = seal_check_write(info->seals, vma);
 	if (ret)
 		return ret;
 
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 2bedc9940c47..130d53f0bd66 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -3201,25 +3201,26 @@ unsigned long wp_shared_mapping_range(struct address_space *mapping,
 extern int sysctl_nr_trim_pages;
 
 /**
- * seal_check_future_write - Check for F_SEAL_FUTURE_WRITE flag and handle it
+ * seal_check_write - Check for F_SEAL_WRITE or F_SEAL_FUTURE_WRITE flags and
+ *                    handle them.
  * @seals: the seals to check
  * @vma: the vma to operate on
  *
- * Check whether F_SEAL_FUTURE_WRITE is set; if so, do proper check/handling on
- * the vma flags.  Return 0 if check pass, or <0 for errors.
+ * Check whether F_SEAL_WRITE or F_SEAL_FUTURE_WRITE are set; if so, do proper
+ * check/handling on the vma flags.  Return 0 if check pass, or <0 for errors.
  */
-static inline int seal_check_future_write(int seals, struct vm_area_struct *vma)
+static inline int seal_check_write(int seals, struct vm_area_struct *vma)
 {
-	if (seals & F_SEAL_FUTURE_WRITE) {
+	if (seals & (F_SEAL_WRITE | F_SEAL_FUTURE_WRITE)) {
 		/*
 		 * New PROT_WRITE and MAP_SHARED mmaps are not allowed when
-		 * "future write" seal active.
+		 * write seals are active.
 		 */
 		if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_WRITE))
 			return -EPERM;
 
 		/*
-		 * Since an F_SEAL_FUTURE_WRITE sealed memfd can be mapped as
+		 * Since an F_SEAL_[FUTURE_]WRITE sealed memfd can be mapped as
 		 * MAP_SHARED and read-only, take care to not allow mprotect to
 		 * revert protections on such mappings. Do this only for shared
 		 * mappings. For private mappings, don't need to mask
diff --git a/mm/shmem.c b/mm/shmem.c
index 6666114ed53b..5f8d8899bd0e 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2263,7 +2263,7 @@ static int shmem_mmap(struct file *file, struct vm_area_struct *vma)
 	struct shmem_inode_info *info = SHMEM_I(file_inode(file));
 	int ret;
 
-	ret = seal_check_future_write(info->seals, vma);
+	ret = seal_check_write(info->seals, vma);
 	if (ret)
 		return ret;
 
-- 
2.50.1.552.g942d659e1b-goog

[PATCH 5.10.y 3/4] mm: reinstate ability to map write-sealed memfd mappings read-only

[Isaac J. Manjarres]

From: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>

[ Upstream commit 8ec396d05d1b737c87311fb7311f753b02c2a6b1 ]

Patch series "mm: reinstate ability to map write-sealed memfd mappings
read-only".

In commit 158978945f31 ("mm: perform the mapping_map_writable() check
after call_mmap()") (and preceding changes in the same series) it became
possible to mmap() F_SEAL_WRITE sealed memfd mappings read-only.

Commit 5de195060b2e ("mm: resolve faulty mmap_region() error path
behaviour") unintentionally undid this logic by moving the
mapping_map_writable() check before the shmem_mmap() hook is invoked,
thereby regressing this change.

This series reworks how we both permit write-sealed mappings being mapped
read-only and disallow mprotect() from undoing the write-seal, fixing this
regression.

We also add a regression test to ensure that we do not accidentally
regress this in future.

Thanks to Julian Orth for reporting this regression.

This patch (of 2):

In commit 158978945f31 ("mm: perform the mapping_map_writable() check
after call_mmap()") (and preceding changes in the same series) it became
possible to mmap() F_SEAL_WRITE sealed memfd mappings read-only.

This was previously unnecessarily disallowed, despite the man page
documentation indicating that it would be, thereby limiting the usefulness
of F_SEAL_WRITE logic.

We fixed this by adapting logic that existed for the F_SEAL_FUTURE_WRITE
seal (one which disallows future writes to the memfd) to also be used for
F_SEAL_WRITE.

For background - the F_SEAL_FUTURE_WRITE seal clears VM_MAYWRITE for a
read-only mapping to disallow mprotect() from overriding the seal - an
operation performed by seal_check_write(), invoked from shmem_mmap(), the
f_op->mmap() hook used by shmem mappings.

By extending this to F_SEAL_WRITE and critically - checking
mapping_map_writable() to determine if we may map the memfd AFTER we
invoke shmem_mmap() - the desired logic becomes possible.  This is because
mapping_map_writable() explicitly checks for VM_MAYWRITE, which we will
have cleared.

Commit 5de195060b2e ("mm: resolve faulty mmap_region() error path
behaviour") unintentionally undid this logic by moving the
mapping_map_writable() check before the shmem_mmap() hook is invoked,
thereby regressing this change.

We reinstate this functionality by moving the check out of shmem_mmap()
and instead performing it in do_mmap() at the point at which VMA flags are
being determined, which seems in any case to be a more appropriate place
in which to make this determination.

In order to achieve this we rework memfd seal logic to allow us access to
this information using existing logic and eliminate the clearing of
VM_MAYWRITE from seal_check_write() which we are performing in do_mmap()
instead.

Link: https://lkml.kernel.org/r/99fc35d2c62bd2e05571cf60d9f8b843c56069e0.1732804776.git.lorenzo.stoakes@oracle.com
Fixes: 5de195060b2e ("mm: resolve faulty mmap_region() error path behaviour")
Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Reported-by: Julian Orth <ju.orth@gmail.com>
Closes: https://lore.kernel.org/all/CAHijbEUMhvJTN9Xw1GmbM266FXXv=U7s4L_Jem5x3AaPZxrYpQ@mail.gmail.com/
Cc: Jann Horn <jannh@google.com>
Cc: Liam R. Howlett <Liam.Howlett@Oracle.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
---
 include/linux/memfd.h | 14 +++++++++++
 include/linux/mm.h    | 58 +++++++++++++++++++++++++++++--------------
 mm/memfd.c            |  2 +-
 mm/mmap.c             |  4 +++
 4 files changed, 59 insertions(+), 19 deletions(-)

diff --git a/include/linux/memfd.h b/include/linux/memfd.h
index 4f1600413f91..5d06bba9d7e5 100644
--- a/include/linux/memfd.h
+++ b/include/linux/memfd.h
@@ -6,11 +6,25 @@
 
 #ifdef CONFIG_MEMFD_CREATE
 extern long memfd_fcntl(struct file *file, unsigned int cmd, unsigned long arg);
+unsigned int *memfd_file_seals_ptr(struct file *file);
 #else
 static inline long memfd_fcntl(struct file *f, unsigned int c, unsigned long a)
 {
 	return -EINVAL;
 }
+
+static inline unsigned int *memfd_file_seals_ptr(struct file *file)
+{
+	return NULL;
+}
 #endif
 
+/* Retrieve memfd seals associated with the file, if any. */
+static inline unsigned int memfd_file_seals(struct file *file)
+{
+	unsigned int *sealsp = memfd_file_seals_ptr(file);
+
+	return sealsp ? *sealsp : 0;
+}
+
 #endif /* __LINUX_MEMFD_H */
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 130d53f0bd66..e168d87d6f2e 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -3200,6 +3200,37 @@ unsigned long wp_shared_mapping_range(struct address_space *mapping,
 
 extern int sysctl_nr_trim_pages;
 
+static inline bool is_write_sealed(int seals)
+{
+	return seals & (F_SEAL_WRITE | F_SEAL_FUTURE_WRITE);
+}
+
+/**
+ * is_readonly_sealed - Checks whether write-sealed but mapped read-only,
+ *                      in which case writes should be disallowing moving
+ *                      forwards.
+ * @seals: the seals to check
+ * @vm_flags: the VMA flags to check
+ *
+ * Returns whether readonly sealed, in which case writess should be disallowed
+ * going forward.
+ */
+static inline bool is_readonly_sealed(int seals, vm_flags_t vm_flags)
+{
+	/*
+	 * Since an F_SEAL_[FUTURE_]WRITE sealed memfd can be mapped as
+	 * MAP_SHARED and read-only, take care to not allow mprotect to
+	 * revert protections on such mappings. Do this only for shared
+	 * mappings. For private mappings, don't need to mask
+	 * VM_MAYWRITE as we still want them to be COW-writable.
+	 */
+	if (is_write_sealed(seals) &&
+	    ((vm_flags & (VM_SHARED | VM_WRITE)) == VM_SHARED))
+		return true;
+
+	return false;
+}
+
 /**
  * seal_check_write - Check for F_SEAL_WRITE or F_SEAL_FUTURE_WRITE flags and
  *                    handle them.
@@ -3211,24 +3242,15 @@ extern int sysctl_nr_trim_pages;
  */
 static inline int seal_check_write(int seals, struct vm_area_struct *vma)
 {
-	if (seals & (F_SEAL_WRITE | F_SEAL_FUTURE_WRITE)) {
-		/*
-		 * New PROT_WRITE and MAP_SHARED mmaps are not allowed when
-		 * write seals are active.
-		 */
-		if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_WRITE))
-			return -EPERM;
-
-		/*
-		 * Since an F_SEAL_[FUTURE_]WRITE sealed memfd can be mapped as
-		 * MAP_SHARED and read-only, take care to not allow mprotect to
-		 * revert protections on such mappings. Do this only for shared
-		 * mappings. For private mappings, don't need to mask
-		 * VM_MAYWRITE as we still want them to be COW-writable.
-		 */
-		if (vma->vm_flags & VM_SHARED)
-			vma->vm_flags &= ~(VM_MAYWRITE);
-	}
+	if (!is_write_sealed(seals))
+		return 0;
+
+	/*
+	 * New PROT_WRITE and MAP_SHARED mmaps are not allowed when
+	 * write seals are active.
+	 */
+	if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_WRITE))
+		return -EPERM;
 
 	return 0;
 }
diff --git a/mm/memfd.c b/mm/memfd.c
index 278e5636623e..8ce796ca5bfa 100644
--- a/mm/memfd.c
+++ b/mm/memfd.c
@@ -133,7 +133,7 @@ static int memfd_wait_for_pins(struct address_space *mapping)
 	return error;
 }
 
-static unsigned int *memfd_file_seals_ptr(struct file *file)
+unsigned int *memfd_file_seals_ptr(struct file *file)
 {
 	if (shmem_file(file))
 		return &SHMEM_I(file_inode(file))->seals;
diff --git a/mm/mmap.c b/mm/mmap.c
index 3cc0d56e41ad..4d5e9d085f0a 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -47,6 +47,7 @@
 #include <linux/pkeys.h>
 #include <linux/oom.h>
 #include <linux/sched/mm.h>
+#include <linux/memfd.h>
 
 #include <linux/uaccess.h>
 #include <asm/cacheflush.h>
@@ -1488,6 +1489,7 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
 
 	if (file) {
 		struct inode *inode = file_inode(file);
+		unsigned int seals = memfd_file_seals(file);
 		unsigned long flags_mask;
 
 		if (!file_mmap_ok(file, inode, pgoff, len))
@@ -1532,6 +1534,8 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
 			vm_flags |= VM_SHARED | VM_MAYSHARE;
 			if (!(file->f_mode & FMODE_WRITE))
 				vm_flags &= ~(VM_MAYWRITE | VM_SHARED);
+			else if (is_readonly_sealed(seals, vm_flags))
+				vm_flags &= ~VM_MAYWRITE;
 			fallthrough;
 		case MAP_PRIVATE:
 			if (!(file->f_mode & FMODE_READ))
-- 
2.50.1.552.g942d659e1b-goog

[PATCH 5.10.y 4/4] selftests/memfd: add test for mapping write-sealed memfd read-only

[Isaac J. Manjarres]

From: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>

[ Upstream commit ea0916e01d0b0f2cce1369ac1494239a79827270 ]

Now we have reinstated the ability to map F_SEAL_WRITE mappings read-only,
assert that we are able to do this in a test to ensure that we do not
regress this again.

Link: https://lkml.kernel.org/r/a6377ec470b14c0539b4600cf8fa24bf2e4858ae.1732804776.git.lorenzo.stoakes@oracle.com
Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Jann Horn <jannh@google.com>
Cc: Julian Orth <ju.orth@gmail.com>
Cc: Liam R. Howlett <Liam.Howlett@Oracle.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: stable@vger.kernel.org
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
---
 tools/testing/selftests/memfd/memfd_test.c | 43 ++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/tools/testing/selftests/memfd/memfd_test.c b/tools/testing/selftests/memfd/memfd_test.c
index fba322d1c67a..5d1ad547416a 100644
--- a/tools/testing/selftests/memfd/memfd_test.c
+++ b/tools/testing/selftests/memfd/memfd_test.c
@@ -186,6 +186,24 @@ static void *mfd_assert_mmap_shared(int fd)
 	return p;
 }
 
+static void *mfd_assert_mmap_read_shared(int fd)
+{
+	void *p;
+
+	p = mmap(NULL,
+		 mfd_def_size,
+		 PROT_READ,
+		 MAP_SHARED,
+		 fd,
+		 0);
+	if (p == MAP_FAILED) {
+		printf("mmap() failed: %m\n");
+		abort();
+	}
+
+	return p;
+}
+
 static void *mfd_assert_mmap_private(int fd)
 {
 	void *p;
@@ -802,6 +820,30 @@ static void test_seal_future_write(void)
 	close(fd);
 }
 
+static void test_seal_write_map_read_shared(void)
+{
+	int fd;
+	void *p;
+
+	printf("%s SEAL-WRITE-MAP-READ\n", memfd_str);
+
+	fd = mfd_assert_new("kern_memfd_seal_write_map_read",
+			    mfd_def_size,
+			    MFD_CLOEXEC | MFD_ALLOW_SEALING);
+
+	mfd_assert_add_seals(fd, F_SEAL_WRITE);
+	mfd_assert_has_seals(fd, F_SEAL_WRITE);
+
+	p = mfd_assert_mmap_read_shared(fd);
+
+	mfd_assert_read(fd);
+	mfd_assert_read_shared(fd);
+	mfd_fail_write(fd);
+
+	munmap(p, mfd_def_size);
+	close(fd);
+}
+
 /*
  * Test SEAL_SHRINK
  * Test whether SEAL_SHRINK actually prevents shrinking
@@ -1056,6 +1098,7 @@ int main(int argc, char **argv)
 
 	test_seal_write();
 	test_seal_future_write();
+	test_seal_write_map_read_shared();
 	test_seal_shrink();
 	test_seal_grow();
 	test_seal_resize();
-- 
2.50.1.552.g942d659e1b-goog

Re: [PATCH 5.10.y 0/4] Backport series: "permit write-sealed memfd read-only shared mappings"

[Lorenzo Stoakes]

Hi Isaac,

Thanks very much for all your hard work on this!

I'll respond to this one, but this is a general comment for all the
backports.

I just wonder if this is what backporting is for - really this is a new
feature, yes the documentation is incorrect, which is why I made the
change, but it's sort of debatable if that's a bug or a new feature.

Having said that, I'm not against you doing this, just wondering about
that.

Also - what kind of testing have you do on these series?

Cheers, Lorenzo

On Tue, Jul 29, 2025 at 06:53:58PM -0700, Isaac J. Manjarres wrote:
> Hello,
>
> Until kernel version 6.7, a write-sealed memfd could not be mapped as
> shared and read-only. This was clearly a bug, and was not inline with
> the description of F_SEAL_WRITE in the man page for fcntl()[1].
>
> Lorenzo's series [2] fixed that issue and was merged in kernel version
> 6.7, but was not backported to older kernels. So, this issue is still
> present on kernels 5.4, 5.10, 5.15, 6.1, and 6.6.
>
> This series consists of backports of two of Lorenzo's series [2] and
> [3].
>
> Note: for [2], I dropped the last patch in that series, since it
> wouldn't make sense to apply it due to [4] being part of this tree. In
> lieu of that, I backported [3] to ultimately allow write-sealed memfds
> to be mapped as read-only.
>
> [1] https://man7.org/linux/man-pages/man2/fcntl.2.html
> [2] https://lore.kernel.org/all/913628168ce6cce77df7d13a63970bae06a526e0.1697116581.git.lstoakes@gmail.com/T/#m28fbfb0d5727e5693e54a7fb2e0c9ac30e95eca5
> [3] https://lkml.kernel.org/r/99fc35d2c62bd2e05571cf60d9f8b843c56069e0.1732804776.git.lorenzo.stoakes@oracle.com
> [4] https://lore.kernel.org/all/6e0becb36d2f5472053ac5d544c0edfe9b899e25.1730224667.git.lorenzo.stoakes@oracle.com/T/#u
>
> Lorenzo Stoakes (4):
>   mm: drop the assumption that VM_SHARED always implies writable
>   mm: update memfd seal write check to include F_SEAL_WRITE
>   mm: reinstate ability to map write-sealed memfd mappings read-only
>   selftests/memfd: add test for mapping write-sealed memfd read-only
>
>  fs/hugetlbfs/inode.c                       |  2 +-
>  include/linux/fs.h                         |  4 +-
>  include/linux/memfd.h                      | 14 ++++
>  include/linux/mm.h                         | 80 +++++++++++++++-------
>  kernel/fork.c                              |  2 +-
>  mm/filemap.c                               |  2 +-
>  mm/madvise.c                               |  2 +-
>  mm/memfd.c                                 |  2 +-
>  mm/mmap.c                                  | 10 ++-
>  mm/shmem.c                                 |  2 +-
>  tools/testing/selftests/memfd/memfd_test.c | 43 ++++++++++++
>  11 files changed, 129 insertions(+), 34 deletions(-)
>
> --
> 2.50.1.552.g942d659e1b-goog
>

Re: [PATCH 5.10.y 4/4] selftests/memfd: add test for mapping write-sealed memfd read-only

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: ea0916e01d0b0f2cce1369ac1494239a79827270

WARNING: Author mismatch between patch and upstream commit:
Backport author: Isaac J. Manjarres <isaacmanjarres@google.com>
Commit author: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>

Status in newer kernel trees:
6.15.y | Present (exact SHA1)
6.12.y | Not found
6.6.y | Not found
6.1.y | Not found
5.15.y | Not found

Note: The patch differs from the upstream commit:
---
1:  ea0916e01d0b ! 1:  61035372efce selftests/memfd: add test for mapping write-sealed memfd read-only
    @@ Metadata
      ## Commit message ##
         selftests/memfd: add test for mapping write-sealed memfd read-only
     
    +    [ Upstream commit ea0916e01d0b0f2cce1369ac1494239a79827270 ]
    +
         Now we have reinstated the ability to map F_SEAL_WRITE mappings read-only,
         assert that we are able to do this in a test to ensure that we do not
         regress this again.
    @@ Commit message
         Cc: Shuah Khan <shuah@kernel.org>
         Cc: Vlastimil Babka <vbabka@suse.cz>
         Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    +    Cc: stable@vger.kernel.org
    +    Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
     
      ## tools/testing/selftests/memfd/memfd_test.c ##
     @@ tools/testing/selftests/memfd/memfd_test.c: static void *mfd_assert_mmap_shared(int fd)

---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| 5.10                      | Success     | Success    |

Re: [PATCH 5.10.y 3/4] mm: reinstate ability to map write-sealed memfd mappings read-only

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: 8ec396d05d1b737c87311fb7311f753b02c2a6b1

WARNING: Author mismatch between patch and upstream commit:
Backport author: Isaac J. Manjarres <isaacmanjarres@google.com>
Commit author: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>

Status in newer kernel trees:
6.15.y | Present (exact SHA1)
6.12.y | Present (different SHA1: 464770df4609)
6.6.y | Not found
6.1.y | Not found
5.15.y | Not found

Note: Could not generate a diff with upstream commit:
---
Note: Could not generate diff - patch failed to apply for comparison
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| 5.10                      | Success     | Success    |

Re: [PATCH 5.10.y 2/4] mm: update memfd seal write check to include F_SEAL_WRITE

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: 28464bbb2ddc199433383994bcb9600c8034afa1

WARNING: Author mismatch between patch and upstream commit:
Backport author: Isaac J. Manjarres <isaacmanjarres@google.com>
Commit author: Lorenzo Stoakes <lstoakes@gmail.com>

Status in newer kernel trees:
6.15.y | Present (exact SHA1)
6.12.y | Present (exact SHA1)
6.6.y | Not found
6.1.y | Not found
5.15.y | Not found

Note: The patch differs from the upstream commit:
---
1:  28464bbb2ddc ! 1:  157a2af225b0 mm: update memfd seal write check to include F_SEAL_WRITE
    @@ Metadata
      ## Commit message ##
         mm: update memfd seal write check to include F_SEAL_WRITE
     
    +    [ Upstream commit 28464bbb2ddc199433383994bcb9600c8034afa1 ]
    +
         The seal_check_future_write() function is called by shmem_mmap() or
         hugetlbfs_file_mmap() to disallow any future writable mappings of an memfd
         sealed this way.
    @@ Commit message
         Cc: Mike Kravetz <mike.kravetz@oracle.com>
         Cc: Muchun Song <muchun.song@linux.dev>
         Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    +    Cc: stable@vger.kernel.org
    +    Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
     
      ## fs/hugetlbfs/inode.c ##
     @@ fs/hugetlbfs/inode.c: static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
    - 	vm_flags_set(vma, VM_HUGETLB | VM_DONTEXPAND);
    + 	vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND;
      	vma->vm_ops = &hugetlb_vm_ops;
      
     -	ret = seal_check_future_write(info->seals, vma);
    @@ fs/hugetlbfs/inode.c: static int hugetlbfs_file_mmap(struct file *file, struct v
      
     
      ## include/linux/mm.h ##
    -@@ include/linux/mm.h: static inline void mem_dump_obj(void *object) {}
    - #endif
    +@@ include/linux/mm.h: unsigned long wp_shared_mapping_range(struct address_space *mapping,
    + extern int sysctl_nr_trim_pages;
      
      /**
     - * seal_check_future_write - Check for F_SEAL_FUTURE_WRITE flag and handle it
    @@ include/linux/mm.h: static inline void mem_dump_obj(void *object) {}
     
      ## mm/shmem.c ##
     @@ mm/shmem.c: static int shmem_mmap(struct file *file, struct vm_area_struct *vma)
    - 	struct shmem_inode_info *info = SHMEM_I(inode);
    + 	struct shmem_inode_info *info = SHMEM_I(file_inode(file));
      	int ret;
      
     -	ret = seal_check_future_write(info->seals, vma);

---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| 5.10                      | Success     | Success    |

Re: [PATCH 5.10.y 1/4] mm: drop the assumption that VM_SHARED always implies writable

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: e8e17ee90eaf650c855adb0a3e5e965fd6692ff1

WARNING: Author mismatch between patch and upstream commit:
Backport author: Isaac J. Manjarres <isaacmanjarres@google.com>
Commit author: Lorenzo Stoakes <lstoakes@gmail.com>

Status in newer kernel trees:
6.15.y | Present (exact SHA1)
6.12.y | Present (exact SHA1)
6.6.y | Not found
6.1.y | Not found
5.15.y | Not found

Note: The patch differs from the upstream commit:
---
1:  e8e17ee90eaf ! 1:  5752dc2ce6f5 mm: drop the assumption that VM_SHARED always implies writable
    @@ Metadata
      ## Commit message ##
         mm: drop the assumption that VM_SHARED always implies writable
     
    +    [ Upstream commit e8e17ee90eaf650c855adb0a3e5e965fd6692ff1 ]
    +
         Patch series "permit write-sealed memfd read-only shared mappings", v4.
     
         The man page for fcntl() describing memfd file seals states the following
    @@ Commit message
         [1]:https://lore.kernel.org/all/20230324133646.16101dfa666f253c4715d965@linux-foundation.org/
         [2]:https://bugzilla.kernel.org/show_bug.cgi?id=217238
     
    -
         This patch (of 3):
     
         There is a general assumption that VMAs with the VM_SHARED flag set are
    @@ Commit message
         Cc: Mike Kravetz <mike.kravetz@oracle.com>
         Cc: Muchun Song <muchun.song@linux.dev>
         Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    +    Cc: stable@vger.kernel.org
    +    [isaacmanjarres: resolved merge conflicts due to
    +    due to refactoring that happened in upstream commit
    +    5de195060b2e ("mm: resolve faulty mmap_region() error path behaviour")]
    +    Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
     
      ## include/linux/fs.h ##
    -@@ include/linux/fs.h: extern const struct address_space_operations empty_aops;
    -  *   It is also used to block modification of page cache contents through
    -  *   memory mappings.
    +@@ include/linux/fs.h: int pagecache_write_end(struct file *, struct address_space *mapping,
    +  * @host: Owner, either the inode or the block_device.
    +  * @i_pages: Cached pages.
       * @gfp_mask: Memory allocation flags to use for allocating pages.
     - * @i_mmap_writable: Number of VM_SHARED mappings.
     + * @i_mmap_writable: Number of VM_SHARED, VM_MAYWRITE mappings.
    @@ include/linux/mm.h: static inline bool vma_is_accessible(struct vm_area_struct *
     +	return is_shared_maywrite(vma->vm_flags);
     +}
     +
    - static inline
    - struct vm_area_struct *vma_find(struct vma_iterator *vmi, unsigned long max)
    - {
    + #ifdef CONFIG_SHMEM
    + /*
    +  * The vma_is_shmem is not inline because it is used only by slow
     
      ## kernel/fork.c ##
     @@ kernel/fork.c: static __latent_entropy int dup_mmap(struct mm_struct *mm,
    - 
    - 			get_file(file);
    + 			if (tmp->vm_flags & VM_DENYWRITE)
    + 				put_write_access(inode);
      			i_mmap_lock_write(mapping);
     -			if (tmp->vm_flags & VM_SHARED)
     +			if (vma_is_shared_maywrite(tmp))
    @@ kernel/fork.c: static __latent_entropy int dup_mmap(struct mm_struct *mm,
      			/* insert tmp into the share list, just after mpnt */
     
      ## mm/filemap.c ##
    -@@ mm/filemap.c: int generic_file_mmap(struct file *file, struct vm_area_struct *vma)
    +@@ mm/filemap.c: int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
       */
      int generic_file_readonly_mmap(struct file *file, struct vm_area_struct *vma)
      {
    @@ mm/madvise.c: static long madvise_remove(struct vm_area_struct *vma,
      	offset = (loff_t)(start - vma->vm_start)
     
      ## mm/mmap.c ##
    -@@ mm/mmap.c: void vma_set_page_prot(struct vm_area_struct *vma)
    - static void __remove_shared_vm_struct(struct vm_area_struct *vma,
    - 		struct file *file, struct address_space *mapping)
    +@@ mm/mmap.c: static void __remove_shared_vm_struct(struct vm_area_struct *vma,
      {
    + 	if (vma->vm_flags & VM_DENYWRITE)
    + 		allow_write_access(file);
     -	if (vma->vm_flags & VM_SHARED)
     +	if (vma_is_shared_maywrite(vma))
      		mapping_unmap_writable(mapping);
      
      	flush_dcache_mmap_lock(mapping);
    -@@ mm/mmap.c: static unsigned long count_vma_pages_range(struct mm_struct *mm,
    - static void __vma_link_file(struct vm_area_struct *vma,
    - 			    struct address_space *mapping)
    - {
    --	if (vma->vm_flags & VM_SHARED)
    -+	if (vma_is_shared_maywrite(vma))
    - 		mapping_allow_writable(mapping);
    - 
    - 	flush_dcache_mmap_lock(mapping);
    -@@ mm/mmap.c: unsigned long mmap_region(struct file *file, unsigned long addr,
    - 	vma->vm_pgoff = pgoff;
    +@@ mm/mmap.c: static void __vma_link_file(struct vm_area_struct *vma)
      
    - 	if (file) {
    --		if (vm_flags & VM_SHARED) {
    -+		if (is_shared_maywrite(vm_flags)) {
    - 			error = mapping_map_writable(file->f_mapping);
    - 			if (error)
    - 				goto free_vma;
    -@@ mm/mmap.c: unsigned long mmap_region(struct file *file, unsigned long addr,
    - 	mm->map_count++;
    - 	if (vma->vm_file) {
    - 		i_mmap_lock_write(vma->vm_file->f_mapping);
    + 		if (vma->vm_flags & VM_DENYWRITE)
    + 			put_write_access(file_inode(file));
     -		if (vma->vm_flags & VM_SHARED)
     +		if (vma_is_shared_maywrite(vma))
    - 			mapping_allow_writable(vma->vm_file->f_mapping);
    + 			mapping_allow_writable(mapping);
      
    - 		flush_dcache_mmap_lock(vma->vm_file->f_mapping);
    + 		flush_dcache_mmap_lock(mapping);
     @@ mm/mmap.c: unsigned long mmap_region(struct file *file, unsigned long addr,
    + 		return -EINVAL;
      
    - 	/* Once vma denies write, undo our temporary denial count */
    - unmap_writable:
    --	if (file && vm_flags & VM_SHARED)
    -+	if (file && is_shared_maywrite(vm_flags))
    - 		mapping_unmap_writable(file->f_mapping);
    - 	file = vma->vm_file;
    - 	ksm_add_vma(vma);
    -@@ mm/mmap.c: unsigned long mmap_region(struct file *file, unsigned long addr,
    - 		unmap_region(mm, &vmi.mas, vma, prev, next, vma->vm_start,
    - 			     vma->vm_end, vma->vm_end, true);
    - 	}
    --	if (file && (vm_flags & VM_SHARED))
    -+	if (file && is_shared_maywrite(vm_flags))
    - 		mapping_unmap_writable(file->f_mapping);
    - free_vma:
    - 	vm_area_free(vma);
    + 	/* Map writable and ensure this isn't a sealed memfd. */
    +-	if (file && (vm_flags & VM_SHARED)) {
    ++	if (file && is_shared_maywrite(vm_flags)) {
    + 		int error = mapping_map_writable(file->f_mapping);
    + 
    + 		if (error)

---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| 5.10                      | Success     | Success    |

Re: [PATCH 5.10.y 0/4] Backport series: "permit write-sealed memfd read-only shared mappings"

[Isaac Manjarres]

On Wed, Jul 30, 2025 at 03:21:48PM +0100, Lorenzo Stoakes wrote:
> Hi Isaac,
> 
> Thanks very much for all your hard work on this!
> 
> I'll respond to this one, but this is a general comment for all the
> backports.
> 
> I just wonder if this is what backporting is for - really this is a new
> feature, yes the documentation is incorrect, which is why I made the
> change, but it's sort of debatable if that's a bug or a new feature.

Hi Lorenzo,

Thanks for your feedback on this. That's a good question. The rationale
that I had when backporting these fixes was: The original intent of
F_SEAL_WRITE was to just prevent any writes to region after it had
been write-sealed, and that the existing behavior on older kernels
may have been a result of oversight or just an accident, making it a
bug. So fixing it would be fixing a bug that has been around for a
while. I hadn't really thought of it as a new feature.

I also learned recently that, at least for Android, there were attempts
in the past to map write-sealed memfds as read-only and shared, which
failed. This was surprising to developers, and they ended up working
around it. I'm not sure why it wasn't reported then, but this being
a surprise to multiple developers makes it feel like more of a bug
to me on older kernels.

>
> Having said that, I'm not against you doing this, just wondering about
> that.
> 
> Also - what kind of testing have you do on these series?
I did the following tests:

1. I have a unit test that tries to map write-sealed memfds as
read-only and shared. I verified that this works for each kernel version
that this series is being applied to.

2. Android devices do use memfds as well, so I did try these patches out
on a device running each kernel version, and tried boot testing, using
several apps/games. I was looking for functional failures in these
scenarios but didn't encounter any.

Do you have any other recommendations of what I should test?

Thanks,
Isaac

> Cheers, Lorenzo
> 
> On Tue, Jul 29, 2025 at 06:53:58PM -0700, Isaac J. Manjarres wrote:
> > Hello,
> >
> > Until kernel version 6.7, a write-sealed memfd could not be mapped as
> > shared and read-only. This was clearly a bug, and was not inline with
> > the description of F_SEAL_WRITE in the man page for fcntl()[1].
> >
> > Lorenzo's series [2] fixed that issue and was merged in kernel version
> > 6.7, but was not backported to older kernels. So, this issue is still
> > present on kernels 5.4, 5.10, 5.15, 6.1, and 6.6.
> >
> > This series consists of backports of two of Lorenzo's series [2] and
> > [3].
> >
> > Note: for [2], I dropped the last patch in that series, since it
> > wouldn't make sense to apply it due to [4] being part of this tree. In
> > lieu of that, I backported [3] to ultimately allow write-sealed memfds
> > to be mapped as read-only.
> >
> > [1] https://man7.org/linux/man-pages/man2/fcntl.2.html
> > [2] https://lore.kernel.org/all/913628168ce6cce77df7d13a63970bae06a526e0.1697116581.git.lstoakes@gmail.com/T/#m28fbfb0d5727e5693e54a7fb2e0c9ac30e95eca5
> > [3] https://lkml.kernel.org/r/99fc35d2c62bd2e05571cf60d9f8b843c56069e0.1732804776.git.lorenzo.stoakes@oracle.com
> > [4] https://lore.kernel.org/all/6e0becb36d2f5472053ac5d544c0edfe9b899e25.1730224667.git.lorenzo.stoakes@oracle.com/T/#u
> >
> > Lorenzo Stoakes (4):
> >   mm: drop the assumption that VM_SHARED always implies writable
> >   mm: update memfd seal write check to include F_SEAL_WRITE
> >   mm: reinstate ability to map write-sealed memfd mappings read-only
> >   selftests/memfd: add test for mapping write-sealed memfd read-only
> >
> >  fs/hugetlbfs/inode.c                       |  2 +-
> >  include/linux/fs.h                         |  4 +-
> >  include/linux/memfd.h                      | 14 ++++
> >  include/linux/mm.h                         | 80 +++++++++++++++-------
> >  kernel/fork.c                              |  2 +-
> >  mm/filemap.c                               |  2 +-
> >  mm/madvise.c                               |  2 +-
> >  mm/memfd.c                                 |  2 +-
> >  mm/mmap.c                                  | 10 ++-
> >  mm/shmem.c                                 |  2 +-
> >  tools/testing/selftests/memfd/memfd_test.c | 43 ++++++++++++
> >  11 files changed, 129 insertions(+), 34 deletions(-)
> >
> > --
> > 2.50.1.552.g942d659e1b-goog
> >

Re: [PATCH 5.10.y 0/4] Backport series: "permit write-sealed memfd read-only shared mappings"

[Lorenzo Stoakes]

On Wed, Jul 30, 2025 at 10:23:54AM -0700, Isaac Manjarres wrote:
> On Wed, Jul 30, 2025 at 03:21:48PM +0100, Lorenzo Stoakes wrote:
> > Hi Isaac,
> >
> > Thanks very much for all your hard work on this!
> >
> > I'll respond to this one, but this is a general comment for all the
> > backports.
> >
> > I just wonder if this is what backporting is for - really this is a new
> > feature, yes the documentation is incorrect, which is why I made the
> > change, but it's sort of debatable if that's a bug or a new feature.
>
> Hi Lorenzo,
>
> Thanks for your feedback on this. That's a good question. The rationale
> that I had when backporting these fixes was: The original intent of
> F_SEAL_WRITE was to just prevent any writes to region after it had
> been write-sealed, and that the existing behavior on older kernels
> may have been a result of oversight or just an accident, making it a
> bug. So fixing it would be fixing a bug that has been around for a
> while. I hadn't really thought of it as a new feature.

Right, makes sense.

>
> I also learned recently that, at least for Android, there were attempts
> in the past to map write-sealed memfds as read-only and shared, which
> failed. This was surprising to developers, and they ended up working
> around it. I'm not sure why it wasn't reported then, but this being
> a surprise to multiple developers makes it feel like more of a bug
> to me on older kernels.

Yeah I always felt the behaviour was surprising, which was what motivated
me in the first place (though at Andy's prompting I believe).

>
> >
> > Having said that, I'm not against you doing this, just wondering about
> > that.
> >
> > Also - what kind of testing have you do on these series?
> I did the following tests:
>
> 1. I have a unit test that tries to map write-sealed memfds as
> read-only and shared. I verified that this works for each kernel version
> that this series is being applied to.
>
> 2. Android devices do use memfds as well, so I did try these patches out
> on a device running each kernel version, and tried boot testing, using
> several apps/games. I was looking for functional failures in these
> scenarios but didn't encounter any.
>
> Do you have any other recommendations of what I should test?

No, that sounds good to me! Thank you for taking the time to implement and
carefully check this :)

In this case I have no objections to these backports!

Cheers, Lorenzo

Re: [PATCH 5.10.y 0/4] Backport series: "permit write-sealed memfd read-only shared mappings"

[Isaac Manjarres]

On Wed, Jul 30, 2025 at 08:34:02PM +0100, Lorenzo Stoakes wrote:
> > >
> > > Having said that, I'm not against you doing this, just wondering about
> > > that.
> > >
> > > Also - what kind of testing have you do on these series?
> > I did the following tests:
> >
> > 1. I have a unit test that tries to map write-sealed memfds as
> > read-only and shared. I verified that this works for each kernel version
> > that this series is being applied to.
> >
> > 2. Android devices do use memfds as well, so I did try these patches out
> > on a device running each kernel version, and tried boot testing, using
> > several apps/games. I was looking for functional failures in these
> > scenarios but didn't encounter any.
> >
> > Do you have any other recommendations of what I should test?
> 
> No, that sounds good to me! Thank you for taking the time to implement and
> carefully check this :)
> 
> In this case I have no objections to these backports!
> 
> Cheers, Lorenzo

Thanks Lorenzo! Just to confirm, is there anything required from my
end for these patches or they'll get reviewed and merged over time?

Thanks,
Isaac

Re: [PATCH 5.10.y 0/4] Backport series: "permit write-sealed memfd read-only shared mappings"

[Lorenzo Stoakes]

On Wed, Jul 30, 2025 at 03:26:01PM -0700, Isaac Manjarres wrote:
> On Wed, Jul 30, 2025 at 08:34:02PM +0100, Lorenzo Stoakes wrote:
> > > >
> > > > Having said that, I'm not against you doing this, just wondering about
> > > > that.
> > > >
> > > > Also - what kind of testing have you do on these series?
> > > I did the following tests:
> > >
> > > 1. I have a unit test that tries to map write-sealed memfds as
> > > read-only and shared. I verified that this works for each kernel version
> > > that this series is being applied to.
> > >
> > > 2. Android devices do use memfds as well, so I did try these patches out
> > > on a device running each kernel version, and tried boot testing, using
> > > several apps/games. I was looking for functional failures in these
> > > scenarios but didn't encounter any.
> > >
> > > Do you have any other recommendations of what I should test?
> >
> > No, that sounds good to me! Thank you for taking the time to implement and
> > carefully check this :)
> >
> > In this case I have no objections to these backports!
> >
> > Cheers, Lorenzo
>
> Thanks Lorenzo! Just to confirm, is there anything required from my
> end for these patches or they'll get reviewed and merged over time?

No, these should all be good to go, Greg + Sasha handle the stable kernels
and should percolate through their process (I see Sasha's scripts have been
firing off already :)

Cheers, Lorenzo

Re: [PATCH 5.10.y 0/4] Backport series: "permit write-sealed memfd read-only shared mappings"

[Greg KH]

On Thu, Jul 31, 2025 at 05:40:29AM +0100, Lorenzo Stoakes wrote:
> On Wed, Jul 30, 2025 at 03:26:01PM -0700, Isaac Manjarres wrote:
> > On Wed, Jul 30, 2025 at 08:34:02PM +0100, Lorenzo Stoakes wrote:
> > > > >
> > > > > Having said that, I'm not against you doing this, just wondering about
> > > > > that.
> > > > >
> > > > > Also - what kind of testing have you do on these series?
> > > > I did the following tests:
> > > >
> > > > 1. I have a unit test that tries to map write-sealed memfds as
> > > > read-only and shared. I verified that this works for each kernel version
> > > > that this series is being applied to.
> > > >
> > > > 2. Android devices do use memfds as well, so I did try these patches out
> > > > on a device running each kernel version, and tried boot testing, using
> > > > several apps/games. I was looking for functional failures in these
> > > > scenarios but didn't encounter any.
> > > >
> > > > Do you have any other recommendations of what I should test?
> > >
> > > No, that sounds good to me! Thank you for taking the time to implement and
> > > carefully check this :)
> > >
> > > In this case I have no objections to these backports!
> > >
> > > Cheers, Lorenzo
> >
> > Thanks Lorenzo! Just to confirm, is there anything required from my
> > end for these patches or they'll get reviewed and merged over time?
> 
> No, these should all be good to go, Greg + Sasha handle the stable kernels
> and should percolate through their process (I see Sasha's scripts have been
> firing off already :)

Yeah, give us a week or so to catch up with all of the recently
submitted changes, the merge window, AND finally, a vacation for the
stable maintainers....

thanks,

greg k-h

Re: [PATCH 5.10.y 0/4] Backport series: "permit write-sealed memfd read-only shared mappings"

[Lorenzo Stoakes]

On Thu, Jul 31, 2025 at 06:58:41AM +0200, Greg KH wrote:
> Yeah, give us a week or so to catch up with all of the recently
> submitted changes, the merge window, AND finally, a vacation for the
> stable maintainers....

You guys are allowed those? :P

Re: [PATCH 5.10.y 0/4] Backport series: "permit write-sealed memfd read-only shared mappings"

[Isaac Manjarres]

On Thu, Jul 31, 2025 at 06:58:41AM +0200, Greg KH wrote:
> On Thu, Jul 31, 2025 at 05:40:29AM +0100, Lorenzo Stoakes wrote:
> > On Wed, Jul 30, 2025 at 03:26:01PM -0700, Isaac Manjarres wrote:
> > > On Wed, Jul 30, 2025 at 08:34:02PM +0100, Lorenzo Stoakes wrote:
> > > > > >
> > > > > > Having said that, I'm not against you doing this, just wondering about
> > > > > > that.
> > > > > >
> > > > > > Also - what kind of testing have you do on these series?
> > > > > I did the following tests:
> > > > >
> > > > > 1. I have a unit test that tries to map write-sealed memfds as
> > > > > read-only and shared. I verified that this works for each kernel version
> > > > > that this series is being applied to.
> > > > >
> > > > > 2. Android devices do use memfds as well, so I did try these patches out
> > > > > on a device running each kernel version, and tried boot testing, using
> > > > > several apps/games. I was looking for functional failures in these
> > > > > scenarios but didn't encounter any.
> > > > >
> > > > > Do you have any other recommendations of what I should test?
> > > >
> > > > No, that sounds good to me! Thank you for taking the time to implement and
> > > > carefully check this :)
> > > >
> > > > In this case I have no objections to these backports!
> > > >
> > > > Cheers, Lorenzo
> > >
> > > Thanks Lorenzo! Just to confirm, is there anything required from my
> > > end for these patches or they'll get reviewed and merged over time?
> > 
> > No, these should all be good to go, Greg + Sasha handle the stable kernels
> > and should percolate through their process (I see Sasha's scripts have been
> > firing off already :)
> 
> Yeah, give us a week or so to catch up with all of the recently
> submitted changes, the merge window, AND finally, a vacation for the
> stable maintainers....
> 

Understood. Thank you all for this!

--Isaac