Patch "erofs: verify metadata accesses for file-backed mounts" has been added to the 6.18-stable tree

This is a note to let you know that I've just added the patch titled

erofs: verify metadata accesses for file-backed mounts

to the 6.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
erofs-verify-metadata-accesses-for-file-backed-mount.patch
and it can be found in the queue-6.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

commit f4178da1373dec03d01f1044acb0ff49a4c7f6a9

Author: Gao Xiang <[email protected]>
Date:   Mon Mar 30 10:29:29 2026 +0800

erofs: verify metadata accesses for file-backed mounts

[ Upstream commit 307210c262a29f41d7177851295ea1703bd04175 ]

For file-backed mounts, metadata is fetched via the page cache of backing inodes to avoid double caching and redundant copy ops out of RO uptodate folios, which is used by Android APEXes, ComposeFS, containerd. However, rw_verify_area() was missing prior to metadata accesses.

Similar to vfs_iocb_iter_read(), fix this by:
- Enabling fanotify pre-content hooks on metadata accesses;
- security_file_permission() for security modules.

Verified that fanotify pre-content hooks now works correctly.

Fixes fb176750266a ("erofs: add file-backed mount support")

Acked-by Amir Goldstein <[email protected]>

Reviewed-by Chunhai Guo <[email protected]>

Signed-off-by Gao Xiang <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

fs/erofs/data.c +14 -0

index 8ca29962a3dde..58aea2b48580c 100644
@@ -29,6 +29,20 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t offset, bool need_kmap)
  {
  	pgoff_t index = (buf->off + offset) >> PAGE_SHIFT;
  	struct folio *folio = NULL;
+	loff_t fpos;
+	int err;
+
+	/*
+	 * Metadata access for file-backed mounts reuses page cache of backing
+	 * fs inodes (only folio data will be needed) to prevent double caching.
+	 * However, the data access range must be verified here in advance.
+	 */
+	if (buf->file) {
+		fpos = index << PAGE_SHIFT;
+		err = rw_verify_area(READ, buf->file, &fpos, PAGE_SIZE);
+		if (err < 0)
+			return ERR_PTR(err);
+	}
 
  	if (buf->page) {
  		folio = page_folio(buf->page);