debugfs: Fix lockdown check for mmap_prepare

PATCH Applied Chun-Yi Lee 5 participants 6 messages Jun 15 – Jun 28

Subsystems (2)

Stable branch Driver core

lore

Share & tools

lore

Chun-Yi Lee

author

2026-06-15 10:47 UTC #0 lore raw

PATCH v2 1/1 debugfs: Fix lockdown check for mmap_prepare

From: Chun-Yi Lee <[email protected]>

Commit 651fdda8406d ("relay: update relay to use mmap_prepare") changed the mmap file operation to mmap_prepare for relayfs, but the lockdown check in debugfs was not updated accordingly.

This prevents debugfs from being locked down when the kernel is in integrity mode if a file uses mmap_prepare but not mmap.

Since the conversion to mmap_prepare across the kernel is not yet complete, update the lockdown check to look for both mmap and mmap_prepare to ensure comprehensive coverage.

Fixes 651fdda8406d ("relay: update relay to use mmap_prepare")

Signed-off-by Chun-Yi Lee <[email protected]>

Cc David Howells <[email protected]>

Cc Lorenzo Stoakes <[email protected]>

Cc Andy Shevchenko <[email protected]>

Cc Thomas Gleixner <[email protected]>

Cc Rafael J. Wysocki <[email protected]>

Cc Matthew Garrett <[email protected]>

Cc Greg Kroah-Hartman <[email protected]>

Cc Danilo Krummrich <[email protected]>

Cc [email protected]

---
v2:
- Add explicit From tag to match Signed-off-by.
- Fix Lorenzo's email address.
- Add Cc stable for backporting.
- Check both mmap and mmap_prepare as suggested by Lorenzo.

 fs/debugfs/file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

fs/debugfs/file.c +2 -1

index edd6aafbfbaa..08de6652a4f3 100644
@@ -273,7 +273,8 @@ static int debugfs_locked_down(struct inode *inode,
 	    (!real_fops ||
 	     (!real_fops->unlocked_ioctl &&
 	      !real_fops->compat_ioctl &&
-	      !real_fops->mmap)))
+	      !real_fops->mmap &&
+	      !real_fops->mmap_prepare)))
 		return 0;
 
 	if (security_locked_down(LOCKDOWN_DEBUGFS))

Signature · 1 line

2.43.0

Lorenzo Stoakes

Reviewed-by on v2 1/1

2026-06-15 11:18 UTC #1 lore raw

Quoted 9 lines · Chun-Yi Lee

From: Chun-Yi Lee <[email protected]>
Commit 651fdda8406d ("relay: update relay to use mmap_prepare") changed the mmap file operation to mmap_prepare for relayfs, but the lockdown check in debugfs was not updated accordingly.
This prevents debugfs from being locked down when the kernel is in integrity mode if a file uses mmap_prepare but not mmap.

Quoted 6 lines

Since the conversion to mmap_prepare across the kernel is not yet complete, update the lockdown check to look for both mmap and mmap_prepare to ensure comprehensive coverage.
Fixes 651fdda8406d ("relay: update relay to use mmap_prepare")
Signed-off-by Chun-Yi Lee <[email protected]>

LGTM so:

Reviewed-by Lorenzo Stoakes <[email protected]>

Quoted 36 lines

Cc David Howells <[email protected]>
Cc Lorenzo Stoakes <[email protected]>
Cc Andy Shevchenko <[email protected]>
Cc Thomas Gleixner <[email protected]>
Cc Rafael J. Wysocki <[email protected]>
Cc Matthew Garrett <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
Cc Danilo Krummrich <[email protected]>
Cc [email protected]
Cc [email protected]
Cc [email protected]
---
v2:
- Add explicit From tag to match Signed-off-by.
- Fix Lorenzo's email address.
- Add Cc stable for backporting.
- Check both mmap and mmap_prepare as suggested by Lorenzo.
 fs/debugfs/file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
fs/debugfs/file.c +2 -2
index edd6aafbfbaa..08de6652a4f3 100644
@@ -273,7 +273,8 @@ static int debugfs_locked_down(struct inode *inode,
 	    (!real_fops ||
 	     (!real_fops->unlocked_ioctl &&
 	      !real_fops->compat_ioctl &&
-	      !real_fops->mmap)))
+	      !real_fops->mmap &&
+	      !real_fops->mmap_prepare)))
 		return 0;
 
 	if (security_locked_down(LOCKDOWN_DEBUGFS))
--

Quoted 2 lines

2.43.0

Cheers, Lorenzo

joeyli

2026-06-15 14:54 UTC #2 lore raw

Quoted 14 lines · Lorenzo Stoakes

Quoted 13 lines · Chun-Yi Lee
From: Chun-Yi Lee <[email protected]>
Commit 651fdda8406d ("relay: update relay to use mmap_prepare") changed the mmap file operation to mmap_prepare for relayfs, but the lockdown check in debugfs was not updated accordingly.
This prevents debugfs from being locked down when the kernel is in integrity mode if a file uses mmap_prepare but not mmap.
Since the conversion to mmap_prepare across the kernel is not yet complete, update the lockdown check to look for both mmap and mmap_prepare to ensure comprehensive coverage.

Quoted 7 lines

Quoted 2 lines
Fixes 651fdda8406d ("relay: update relay to use mmap_prepare")
Signed-off-by Chun-Yi Lee <[email protected]>
LGTM so:
Reviewed-by Lorenzo Stoakes <[email protected]>

Thanks for Lorenzo's review!

Joey Lee

Disha Goel

Tested-by on v2 1/1

2026-06-19 11:12 UTC #3 lore raw

In reply to Chun-Yi Lee

Quoted 26 lines · Chun-Yi Lee

From: Chun-Yi Lee <[email protected]>
Commit 651fdda8406d ("relay: update relay to use mmap_prepare") changed the mmap file operation to mmap_prepare for relayfs, but the lockdown check in debugfs was not updated accordingly.
This prevents debugfs from being locked down when the kernel is in integrity mode if a file uses mmap_prepare but not mmap.
Since the conversion to mmap_prepare across the kernel is not yet complete, update the lockdown check to look for both mmap and mmap_prepare to ensure comprehensive coverage.
Fixes 651fdda8406d ("relay: update relay to use mmap_prepare")
Signed-off-by Chun-Yi Lee <[email protected]>
Cc David Howells <[email protected]>
Cc Lorenzo Stoakes <[email protected]>
Cc Andy Shevchenko <[email protected]>
Cc Thomas Gleixner <[email protected]>
Cc Rafael J. Wysocki <[email protected]>
Cc Matthew Garrett <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
Cc Danilo Krummrich <[email protected]>
Cc [email protected]
Cc [email protected]
Cc [email protected]

Quoted 1 line

---

Hi,

I tested this patch on ppc64le with lockdown enabled. It correctly fixes the security issue where debugfs files using mmap_prepare were not being restricted.

Test: blktrace/001 from blktests (uses relayfs via debugfs)
- Before patch: blktrace bypassed lockdown and accessed debugfs
- After patch: blktrace properly blocked from accessing debugfs

Environment:
Kernel: 7.1.0-rc7
Lockdown: integrity mode

Feel free to add:

Tested-by Disha Goel <[email protected]>

Quoted 23 lines

v2:
- Add explicit From tag to match Signed-off-by.
- Fix Lorenzo's email address.
- Add Cc stable for backporting.
- Check both mmap and mmap_prepare as suggested by Lorenzo.

  fs/debugfs/file.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)

fs/debugfs/file.c +2 -1

index edd6aafbfbaa..08de6652a4f3 100644
@@ -273,7 +273,8 @@ static int debugfs_locked_down(struct inode *inode,
  	    (!real_fops ||
  	     (!real_fops->unlocked_ioctl &&
  	      !real_fops->compat_ioctl &&
-	      !real_fops->mmap)))
+	      !real_fops->mmap &&
+	      !real_fops->mmap_prepare)))
  		return 0;
 
  	if (security_locked_down(LOCKDOWN_DEBUGFS))

Signature · 2 lines

Regards,
Disha

joeyli

2026-06-23 06:11 UTC #4 lore raw

Hi Disha,

Quoted 39 lines · Disha Goel

Quoted 26 lines · Chun-Yi Lee
From: Chun-Yi Lee <[email protected]>
Commit 651fdda8406d ("relay: update relay to use mmap_prepare") changed the mmap file operation to mmap_prepare for relayfs, but the lockdown check in debugfs was not updated accordingly.
This prevents debugfs from being locked down when the kernel is in integrity mode if a file uses mmap_prepare but not mmap.
Since the conversion to mmap_prepare across the kernel is not yet complete, update the lockdown check to look for both mmap and mmap_prepare to ensure comprehensive coverage.
Fixes 651fdda8406d ("relay: update relay to use mmap_prepare")
Signed-off-by Chun-Yi Lee <[email protected]>
Cc David Howells <[email protected]>
Cc Lorenzo Stoakes <[email protected]>
Cc Andy Shevchenko <[email protected]>
Cc Thomas Gleixner <[email protected]>
Cc Rafael J. Wysocki <[email protected]>
Cc Matthew Garrett <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
Cc Danilo Krummrich <[email protected]>
Cc [email protected]
Cc [email protected]
Cc [email protected]
Quoted 1 line
---
Hi,
I tested this patch on ppc64le with lockdown enabled. It correctly fixes the security issue where debugfs files using mmap_prepare were not being restricted.
Test: blktrace/001 from blktests (uses relayfs via debugfs)
- Before patch: blktrace bypassed lockdown and accessed debugfs
- After patch: blktrace properly blocked from accessing debugfs

Quoted 7 lines

Environment:
Kernel: 7.1.0-rc7
Lockdown: integrity mode
Feel free to add:
Tested-by Disha Goel <[email protected]>

Thanks for your testing!

Joey Lee

Danilo Krummrich

maintainer Applied

2026-06-28 23:09 UTC #5 lore raw

In reply to Chun-Yi Lee

Quoted 1 line · Chun-Yi Lee

[PATCH v2] debugfs: Fix lockdown check for mmap_prepare

Applied, thanks!

Branch: driver-core-testing
Tree: git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core.git

[1/1] debugfs: Fix lockdown check for mmap_prepare

      commit: f81808de3733

The patch will appear in the next linux-next integration (typically within 24 hours on weekdays).

The patch is in the driver-core-testing branch and will be promoted to driver-core-next after validation.