From: Eva Kurchatova F_SEAL_EXEC is enforced by shmem_setattr(), but hugetlbfs_setattr() does not check it. As a result, fchmod() can change the execute bits of a sealed hugetlbfs memfd. Use memfd_check_seals_mode() in hugetlbfs_setattr() to reject changes to execute bits when F_SEAL_EXEC is set. This also fixes the memfd_test hugetlbfs SEAL-EXEC subtest, where fchmod() incorrectly succeeded after applying F_SEAL_EXEC. LLM assistance was used to reuse the helper and revise the description. Fixes: 6fd7353829ca ("mm/memfd: add F_SEAL_EXEC") Cc: stable@vger.kernel.org Signed-off-by: Eva Kurchatova Link: https://patch.msgid.link/20260629180247.2343229-1-eva.kurchatova@virtuozzo.com [ david: use common helper; fixup Fixes: ] Signed-off-by: David Hildenbrand (Arm) --- fs/hugetlbfs/inode.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 6656807ce4377..7f5c3962b5d56 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -28,6 +28,7 @@ #include #include #include +#include #include #include #include @@ -841,6 +842,13 @@ static int hugetlbfs_setattr(const struct mnt_idmap *idmap, if (error) return error; + if (ia_valid & ATTR_MODE) { + error = memfd_check_seals_mode(info->seals, inode->i_mode, + attr->ia_mode); + if (error) + return error; + } + trace_hugetlbfs_setattr(inode, dentry, attr); if (ia_valid & ATTR_SIZE) { -- 2.43.0