Re: mm: call the security_mmap_file() LSM hook in remap_file_pages()

[gregkh <gregkh@linuxfoundation.org>]

On Tue, Oct 27, 2026 at 11:37:21AM +0800, yao.zhang1@amlogic.com wrote:
> Dear 5.15.y maintainers,
> 
> An mm patch should be backported from upstream mainline to the stable
> 5.15.y branch. The patch's information is shown as below:
> 
> [Subject]
> mm: call the security_mmap_file() LSM hook in remap_file_pages()
> 
> [Upstream commit ID]
> 0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1
> 
> [Kernel version]
> 5.15.y
> 
> [Why]
> The remap_file_pages syscall handler calls do_mmap() directly, which
> doesn't contain the LSM security check. And if the process has called
> personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for
> RW pages, this will actually result in remapping the pages to RWX,
> bypassing a W^X policy enforced by SELinux.
> So we should check prot by security_mmap_file LSM hook in the
> remap_file_pages syscall handler before do_mmap() is called. Otherwise, it
> potentially permits an attacker to bypass a W^X policy enforced by
> SELinux.

Please provide a working backport that you have tested for this, as it
does not apply cleanly on its own.

Also note that 5.15.y will only be alive for one more month, so why
aren't you moving off of this kernel version already instead of wanting
to add a new bugfix to it when there are already 2000+ unfixed CVEs in
that tree?

thanks,

greg k-h