Re: mm: call the security_mmap_file() LSM hook in remap_file_pages()

["yao.zhang1@amlogic.com" <yao.zhang1@amlogic.com>]

Hi gregkh

I have verified the following:

1. The patch can be applied to the `linux-5.15.y` branch.
The commit applies cleanly on top of v5.15.223
(using `git cherry-pick -x`, with no conflicts):

git cherry-pick -x 0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1
with no conflicts

git log --oneline
it can view the commit history.

2. Our customer is using the `5.15.y` branch
The customer has requested the inclusion of these CVEs.
and is unwilling to upgrade to version 6.x or higher.

Furthermore, as they are using GKI 2.0, they cannot apply "autopatch."
the only way to incorporate fixes for CVEs is by updating the LTS.


-------------------------------------
From: gregkh


Date: 2026-10-27 13:50



To: yao.zhang1@amlogic.com



CC: stable; tuan.zhang; jianxin.pan



Subject: Re: mm: call the security_mmap_file() LSM hook in remap_file_pages()



[ EXTERNAL EMAIL ]



 



On Tue, Oct 27, 2026 at 11:37:21AM +0800, yao.zhang1@amlogic.com wrote:



> Dear 5.15.y maintainers,



>



> An mm patch should be backported from upstream mainline to the stable



> 5.15.y branch. The patch's information is shown as below:



>



> [Subject]



> mm: call the security_mmap_file() LSM hook in remap_file_pages()



>



> [Upstream commit ID]



> 0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1



>



> [Kernel version]



> 5.15.y



>



> [Why]



> The remap_file_pages syscall handler calls do_mmap() directly, which



> doesn't contain the LSM security check. And if the process has called



> personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for



> RW pages, this will actually result in remapping the pages to RWX,



> bypassing a W^X policy enforced by SELinux.



> So we should check prot by security_mmap_file LSM hook in the



> remap_file_pages syscall handler before do_mmap() is called. Otherwise, it



> potentially permits an attacker to bypass a W^X policy enforced by



> SELinux.



 



Please provide a working backport that you have tested for this, as it



does not apply cleanly on its own.



 



Also note that 5.15.y will only be alive for one more month, so why



aren't you moving off of this kernel version already instead of wanting



to add a new bugfix to it when there are already 2000+ unfixed CVEs in



that tree?



thanks,





greg k-h