linux-kernel - Regression: mmap rejects shared, read-only mappings of write-sealed memfds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHijbEUMhvJTN9Xw1GmbM266FXXv=U7s4L_Jem5x3AaPZxrYpQ@mail.gmail.com>
Date: Wed, 27 Nov 2024 21:49:29 +0100
From: Julian Orth <ju.orth@...il.com>
To: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
Cc: linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Regression: mmap rejects shared, read-only mappings of write-sealed memfds

Since around

    5de19506 mm: resolve faulty mmap_region() error path behaviour

mmap rejects shared, read-only mapping of memfds that have a write-seal applied.

Before the commit, the code in mmap_region was

    if (file) {
        vma->vm_file = get_file(file);
        error = mmap_file(file, vma);
        if (error)
            goto unmap_and_free_vma;

        if (vma_is_shared_maywrite(vma)) {
            error = mapping_map_writable(file->f_mapping);

where mmap_file would clear the VM_MAYWRITE flag for write-sealed memfds.

After the commit, the code in mmap_region is simply

    if (file && is_shared_maywrite(vm_flags)) {
        int error = mapping_map_writable(file->f_mapping);

with mmap_file not being called until much later.

This regression seems to have been first released in 6.12 and is still
present on master.