From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794669854; b=zNa+zt6ibF0mzUvaZyM/fCDf71laBkChaRRRRca9k3D3scQJpeQcd65CPca8J5g8sb4k PEjbeDwrVh8AvIvhgDPWK/9+iaVvuDSi65yt2NBqpu/qDTDTeWvvLQMqlQY9Dw4bvd1te yaY9+wo0saRaA44VG9viFGd4ZmNcHVuxKYU58ZJGzycoiNg8hmTBXbiyVI+cUjh5KxXDA kbUZdIKvlysQ684QpbfSccmZR433RSDdeiRC1+yafdh2O4JhmN910y69PC1l6/1DzaSFE xt2xOrgG9y+UK0Gp7sT3Xg810qKoO6oOQ/ELUrDrkKg5KjO4S+ScFvQ49dZrkpInSHQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794669854; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=CoXnC1tPBI1LFwh7h6dEj9gOVxNtcdjV3JxT2bwo9Aw=; b=ql0EH3v78tUR9hdi6w+dZj6tWQWPQDyN6aYGTbpUFtu80eObm3XuW4SZSV8NU6LAjCFE 6epmozY7gS55X2ManbqOddzvbJh7/+9MHPCro/OWQ1fNdFpZsUjFAdFkFNptwUvm0Vme6 tWszCymKYhmFdEWymdazu41QO0LH6CllG1wgHmse3xoeN2lm28G58k3qDSQqZ7e550WGj vHUoi9lTkaUGpMv9nIV7OkQ+IhCIOI7Acq0M3c+5rdC6cBm5uUpC+b3ihOS2cU4VMalAU fyQcoLSJfJtnoVan0/08hE7z3ZC5RPjKpDDGW/In5G41q2sgeGl9uLxKIRxqKxQKodQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=Uso5uN82; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BE048606A327 for ; Sat, 14 Nov 2026 15:24:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=Uso5uN82 Received: by smtp.kernel.org (Postfix) with ESMTPSA id A5FB91F000C5; Sat, 14 Nov 2026 15:24:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794669854; bh=CoXnC1tPBI1LFwh7h6dEj9gOVxNtcdjV3JxT2bwo9Aw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Uso5uN82u11bM2efZ1Jy0fG+XKRlyteXUpnMew8lZL/xfg8YmZCMWipZ/IrsMFtvU JbvpBTvsQQ6aKg+sFE/4ayn3HzEPHAPswBUFzfSij/+u3kqeg2McL+nrWEpsDhDOlR vnlwpHVbjzxz51FRf6Oun+4HWOYbgIRlhH4cUKzFXlVMRFKsurnkF0rNmZbadlUw9S zrGCGiUN+abXTTeaJHk7NcV8ooQGDmw2wxUvTj+HrfVdu2PT9oSMQWD90JZHVEWsQl zVcwt4WtP+eUzu0B5bDjhtw7MwXIiMU8SOj0Ua4pazJBJxdjowZjz6RBApotPdVUHB 4/oSolKh7d/Kg== From: Sasha Levin To: stable@vger.kernel.org Cc: "David Hildenbrand (Arm)" , Chris Mason , Pratyush Yadav , Baolin Wang , Sasha Levin Subject: [PATCH 5.15.y] mm/shmem: make shmem_file() check the file's inode Date: Sat, 14 Nov 2026 10:24:12 -0500 Message-ID: <20261114152354.3620753-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261109202102-failed-5.15-d3710111839d@kernel.org> References: <20261109202102-failed-5.15-d3710111839d@kernel.org> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: "David Hildenbrand (Arm)" [ Upstream commit d3710111839d11339e414b1bb3fea3d05ab83f6e ] shmem_file() only checks if file->f_mapping is a shmem mapping. This mapping can belong to another file, however, as with a Coda file backed by a tmpfs container after mmap(). So it does not guarantee that the file inode is an actual shmem inode. Seal handling and memfd preservation use this check before accessing shmem inode state, so they can access an inode of the wrong type. Let's make shmem_file() check the inode's file operations instead, to identify shmem inodes reliably. This will identify regular shmem inodes, including memfds and ordinary tmpfs files, independently of wrapper file operations. Use shmem_mapping() in collapse_file() instead to not change the behavior of collapse_file(): it operates on the page cache and uses mapping->host for shmem inode operations. Focusing on the file does not seem relevant. Fixes: c49fcfcda8b5 ("mm/shmem: update file sealing comments and file checking") Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd") Cc: stable@vger.kernel.org Reported-by: Chris Mason Suggested-by: Pratyush Yadav Reviewed-by: Pratyush Yadav (Google) Link: https://patch.msgid.link/20261031-fixes_core-v3-3-d6437171ecc3@kernel.org Reviewed-by: Baolin Wang Signed-off-by: David Hildenbrand (Arm) [ sashal: Adjusted context to retain the existing inline shmem_mapping() helper. ] Signed-off-by: Sasha Levin --- include/linux/shmem_fs.h | 15 ++++++--------- mm/khugepaged.c | 2 +- mm/shmem.c | 5 +++++ 3 files changed, 12 insertions(+), 10 deletions(-) diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h index 166158b6e917a..d6aeccd1d22a0 100644 --- a/include/linux/shmem_fs.h +++ b/include/linux/shmem_fs.h @@ -68,12 +68,18 @@ extern unsigned long shmem_get_unmapped_area(struct file *, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags); extern int shmem_lock(struct file *file, int lock, struct ucounts *ucounts); #ifdef CONFIG_SHMEM +bool shmem_file(struct file *file); extern const struct address_space_operations shmem_aops; static inline bool shmem_mapping(struct address_space *mapping) { return mapping->a_ops == &shmem_aops; } #else +static inline bool shmem_file(struct file *file) +{ + return false; +} + static inline bool shmem_mapping(struct address_space *mapping) { return false; @@ -115,15 +121,6 @@ static inline struct page *shmem_read_mapping_page( mapping_gfp_mask(mapping)); } -static inline bool shmem_file(struct file *file) -{ - if (!IS_ENABLED(CONFIG_SHMEM)) - return false; - if (!file || !file->f_mapping) - return false; - return shmem_mapping(file->f_mapping); -} - /* * If fallocate(FALLOC_FL_KEEP_SIZE) has been used, there may be pages * beyond i_size's notion of EOF, which fallocate has committed to reserving: diff --git a/mm/khugepaged.c b/mm/khugepaged.c index a7a8e6bc70b01..bd909aa4b8fee 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -1694,13 +1694,13 @@ static void collapse_file(struct mm_struct *mm, struct page **hpage, int node) { struct address_space *mapping = file->f_mapping; + const bool is_shmem = shmem_mapping(mapping); gfp_t gfp; struct page *new_page; pgoff_t index, end = start + HPAGE_PMD_NR; LIST_HEAD(pagelist); XA_STATE_ORDER(xas, &mapping->i_pages, start, HPAGE_PMD_ORDER); int nr_none = 0, result = SCAN_SUCCEED; - bool is_shmem = shmem_file(file); int nr; VM_BUG_ON(!IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) && !is_shmem); diff --git a/mm/shmem.c b/mm/shmem.c index cc5b08d9802cf..1ad2d64d18470 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -250,6 +250,11 @@ static const struct inode_operations shmem_special_inode_operations; static const struct vm_operations_struct shmem_vm_ops; static struct file_system_type shmem_fs_type; +bool shmem_file(struct file *file) +{ + return file && file_inode(file)->i_fop == &shmem_file_operations; +} + bool vma_is_shmem(struct vm_area_struct *vma) { return vma->vm_ops == &shmem_vm_ops; -- 2.53.0