[PATCH 03/46] mm/memfd: check for real shmem inodes before accessing shmem state

[Rik van Riel]

On Tue, 2026-10-27 at 00:17 +0100, David Hildenbrand (Arm) wrote:
> shmem_file() only checks a file's backing mapping. That mapping can
> belong
> to another file, as with a Coda file backed by a tmpfs container
> after
> mmap(). It does not establish that file_inode(file) is a shmem inode.
> 
> Seal handling and memfd preservation use this check before accessing
> shmem inode state, so they can access an inode of the wrong type.
> 
> Add file_inode_is_shmem() to check the inode's file operations in
> both
> paths. This identifies regular shmem inodes, including those used by
> memfds and ordinary tmpfs files, independently of wrapper file
> operations.
> 
> Fixes: c49fcfcda8b5 ("mm/shmem: update file sealing comments and file
> checking")
> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> Cc: stable at vger.kernel.org
> Reported-by: Chris Mason <mason at kernel.org>
> Signed-off-by: David Hildenbrand (Arm) <david at kernel.org>

Reviewed-by: Rik van Riel <riel at surriel.com>

-- 
All Rights Reversed.