debugfs: Fix lockdown check for mmap_prepare

PATCH Superseded Chun-Yi Lee 3 participants 3 messages Jun 12 Driver core

Share & tools

Chun-Yi Lee

author

2026-06-12 05:55 UTC #0 lore raw

PATCH 1/1 debugfs: Fix lockdown check for mmap_prepare

Commit 651fdda8406d ("relay: update relay to use mmap_prepare") changed the mmap file operation to mmap_prepare for relayfs, but the lockdown check in debugfs was not updated accordingly.

This prevents debugfs from being locked down when the kernel is in integrity mode if a file uses mmap_prepare but not mmap.

Update the lockdown check to look for mmap_prepare instead of mmap to fix this.

Fixes 651fdda8406d ("relay: update relay to use mmap_prepare")

Signed-off-by Chun-Yi Lee <[email protected]>

Cc David Howells <[email protected]>

Cc Lorenzo Stoakes <[email protected]>

cc Andy Shevchenko <[email protected]>

cc Thomas Gleixner <[email protected]>

Cc Rafael J. Wysocki <[email protected]>

Cc Matthew Garrett <[email protected]>

Cc Greg Kroah-Hartman <[email protected]>

Cc Danilo Krummrich <[email protected]>

Cc [email protected]

---
 fs/debugfs/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

fs/debugfs/file.c +1 -1

index edd6aafbfbaa..d5e187895dd8 100644
@@ -273,7 +273,7 @@ static int debugfs_locked_down(struct inode *inode,
 	    (!real_fops ||
 	     (!real_fops->unlocked_ioctl &&
 	      !real_fops->compat_ioctl &&
-	      !real_fops->mmap)))
+	      !real_fops->mmap_prepare)))
 		return 0;
 
 	if (security_locked_down(LOCKDOWN_DEBUGFS))

Signature · 1 line

2.43.0

Lorenzo Stoakes

2026-06-12 07:28 UTC #1 lore raw

-cc wrong email

(Please make sure to use my correct email address - [email protected] -
I usually do not see emails sent to the incorrect one)

+From: Chun-Yi Lee <[email protected]>

(You're sending from a different email address so you need to explicitly add a From: xxx tag to match the S-o-b at the top of the message)

Quoted 11 lines · Chun-Yi Lee

Commit 651fdda8406d ("relay: update relay to use mmap_prepare") changed the mmap file operation to mmap_prepare for relayfs, but the lockdown check in debugfs was not updated accordingly.
This prevents debugfs from being locked down when the kernel is in integrity mode if a file uses mmap_prepare but not mmap.
Update the lockdown check to look for mmap_prepare instead of mmap to fix this.
Fixes 651fdda8406d ("relay: update relay to use mmap_prepare")

You need to explicitly add:

Cc [email protected]

As we will want this backported.

Quoted 1 line

Signed-off-by Chun-Yi Lee <[email protected]>

I think the idea is correct, but needs tweaking to cover _both_ mmap and mmap_prepare, until the mmap_prepare conversion is complete, see below.

Quoted 19 lines

Cc David Howells <[email protected]>
Cc Lorenzo Stoakes <[email protected]>
cc Andy Shevchenko <[email protected]>
cc Thomas Gleixner <[email protected]>
Cc Rafael J. Wysocki <[email protected]>
Cc Matthew Garrett <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
Cc Danilo Krummrich <[email protected]>
Cc [email protected]
Cc [email protected]
---
 fs/debugfs/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
fs/debugfs/file.c +0 -0
index edd6aafbfbaa..d5e187895dd8 100644

fs/debugfs/file.c static int debugfs_locked_down(struct inode *inode, · line 276

Quoted 5 lines

fs/debugfs/file.c +1 -1

@@ -273,7 +273,7 @@ static int debugfs_locked_down(struct inode *inode,
 	    (!real_fops ||
 	     (!real_fops->unlocked_ioctl &&
 	      !real_fops->compat_ioctl &&
-	      !real_fops->mmap)))
+	      !real_fops->mmap_prepare)))

This is not only applicable to relayfs.

So while we both have mmap and mmap_prepare, this should be:

-	      !real_fops->mmap)))
+	      !real_fops->mmap &&
+	      !real_fops->mmap_prepare)))

Quoted 6 lines

fs/debugfs/file.c +0 -1

 		return 0;
 
 	if (security_locked_down(LOCKDOWN_DEBUGFS))
--

2.43.0

Thanks, Lorenzo

joeyli

2026-06-12 08:56 UTC #2 lore raw

Hi Lorenzo,

Thanks for your review!

Quoted 10 lines · Lorenzo Stoakes

-cc wrong email
(Please make sure to use my correct email address - [email protected] -
I usually do not see emails sent to the incorrect one)
+From: Chun-Yi Lee <[email protected]>
(You're sending from a different email address so you need to explicitly add a From: xxx tag to match the S-o-b at the top of the message)

I will use your kernel.org email address and put From: tag.

Quoted 12 lines · Chun-Yi Lee

Quoted 10 lines
Commit 651fdda8406d ("relay: update relay to use mmap_prepare") changed the mmap file operation to mmap_prepare for relayfs, but the lockdown check in debugfs was not updated accordingly.
This prevents debugfs from being locked down when the kernel is in integrity mode if a file uses mmap_prepare but not mmap.
Update the lockdown check to look for mmap_prepare instead of mmap to fix this.

Quoted 8 lines

Quoted 1 line
Fixes 651fdda8406d ("relay: update relay to use mmap_prepare")
You need to explicitly add:
Cc [email protected]
As we will want this backported.

I will add cc. to stable mailing list.

Quoted 35 lines

Quoted 1 line
Signed-off-by Chun-Yi Lee <[email protected]>
I think the idea is correct, but needs tweaking to cover _both_ mmap and mmap_prepare, until the mmap_prepare conversion is complete, see below.
Quoted 19 lines
Cc David Howells <[email protected]>
Cc Lorenzo Stoakes <[email protected]>
cc Andy Shevchenko <[email protected]>
cc Thomas Gleixner <[email protected]>
Cc Rafael J. Wysocki <[email protected]>
Cc Matthew Garrett <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
Cc Danilo Krummrich <[email protected]>
Cc [email protected]
Cc [email protected]
---
 fs/debugfs/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
fs/debugfs/file.c +0 -0
index edd6aafbfbaa..d5e187895dd8 100644
fs/debugfs/file.c static int debugfs_locked_down(struct inode *inode, · line 276
Quoted 5 lines
fs/debugfs/file.c +1 -1
@@ -273,7 +273,7 @@ static int debugfs_locked_down(struct inode *inode,
 	    (!real_fops ||
 	     (!real_fops->unlocked_ioctl &&
 	      !real_fops->compat_ioctl &&
-	      !real_fops->mmap)))
+	      !real_fops->mmap_prepare)))
This is not only applicable to relayfs.
So while we both have mmap and mmap_prepare, this should be:

fs/debugfs/file.c static int debugfs_locked_down(struct inode *inode, · line 276

Quoted 3 lines

fs/debugfs/file.c +2 -1

-	      !real_fops->mmap)))
+	      !real_fops->mmap &&
+	      !real_fops->mmap_prepare)))

Yes, thanks a lot! I will send v2 patch.

Joey Lee