JIRA: https://issues.redhat.com/browse/RHEL-179443
CVE: CVE-2026-46054
Conflicts:
- fs/backing-file.c:
- adjust backing_file_mmap() to downstream state (missing scoped
guards, ctx->user_file instead of missing user_file variable)
- backing_tmpfile_open() not present downstream
- fs/erofs/ishare.c: hunk dropped, file not present downstream
- fs/file_table.c: context fuzz + put security_backing_file_free() in the
right place
- fs/fuse/passthrough.c: hunk dropped, file not present downstream
- fs/overlayfs/dir.c: hunk dropped, ovl_create_tmpfile() not present downstream
- fs/overlayfs/file.c: adjust to different indentation
- include/linux/backing-file.h: backing_tmpfile_open() not present downstream
- include/linux/lsm_hooks.h: adjust to downstream's definition of struct lsm_blob_sizes
- security/lsm.h: hunk dropped, file not present downstream
- security/lsm_init.c: hunk dropped, file not present downstream
- security/security.c: misc conflicts, port changes to stuff that was
already in lsm.h/lsm_init.c upstream
commit 6af36aeb147a06dea47c49859cd6ca5659aeb987
Author: Paul Moore <paul@paul-moore.com>
Date: Fri Dec 19 13:18:22 2025 -0500
lsm: add backing_file LSM hooks
Stacked filesystems such as overlayfs do not currently provide the
necessary mechanisms for LSMs to properly enforce access controls on the
mmap() and mprotect() operations. In order to resolve this gap, a LSM
security blob is being added to the backing_file struct and the following
new LSM hooks are being created:
security_backing_file_alloc()
security_backing_file_free()
security_mmap_backing_file()
The first two hooks are to manage the lifecycle of the LSM security blob
in the backing_file struct, while the third provides a new mmap() access
control point for the underlying backing file. It is also expected that
LSMs will likely want to update their security_file_mprotect() callback
to address issues with their mprotect() controls, but that does not
require a change to the security_file_mprotect() LSM hook.
There are a three other small changes to support these new LSM hooks:
* Pass the user file associated with a backing file down to
alloc_empty_backing_file() so it can be included in the
security_backing_file_alloc() hook.
* Add getter and setter functions for the backing_file struct LSM blob
as the backing_file struct remains private to fs/file_table.c.
* Constify the file struct field in the LSM common_audit_data struct to
better support LSMs that need to pass a const file struct pointer into
the common LSM audit code.
Thanks to Arnd Bergmann for identifying the missing EXPORT_SYMBOL_GPL()
and supplying a fixup.
Cc: stable@vger.kernel.org
Cc: linux-fsdevel@vger.kernel.org
Cc: linux-unionfs@vger.kernel.org
Cc: linux-erofs@lists.ozlabs.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
JIRA: https://issues.redhat.com/browse/RHEL-179443
CVE: CVE-2026-46054
commit f567377e406c032fff0799bde4fdf4a977529b84
Author: Amir Goldstein <amir73il@gmail.com>
Date: Fri Oct 13 12:49:37 2023 +0300
fs: factor out backing_file_mmap() helper
Assert that the file object is allocated in a backing_file container
so that file_user_path() could be used to display the user path and
not the backing file's path in /proc/<pid>/maps.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
JIRA: https://issues.redhat.com/browse/RHEL-179443
CVE: CVE-2026-46054
commit 9b7e9e2f5d5c3d079ec46bc71b114012e362ea6e
Author: Amir Goldstein <amir73il@gmail.com>
Date: Fri Oct 13 12:13:12 2023 +0300
fs: factor out backing_file_splice_{read,write}() helpers
There is not much in those helpers, but it makes sense to have them
logically next to the backing_file_{read,write}_iter() helpers as they
may grow more common logic in the future.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
JIRA: https://issues.redhat.com/browse/RHEL-179443
CVE: CVE-2026-46054
Conflicts:
- fs/overlayfs/file.c & fs/backing-file.c: carried over downstream
logic of calling *_start_write()/*_end_write() because of not
backported commits: 269aed7014b3 ("fs: move file_start_write() into
vfs_iter_write()") and 6ae654392bb5 ("fs: move kiocb_start_write()
into vfs_iocb_iter_write()") - those commits were skipped in this
MR, because vfs_iter_write() appears in K-A-B-I stable lists and
changing the convention could break partner modules
commit a6293b3e285cd0d7692141d7981a5f144f0e2f0b
Author: Amir Goldstein <amir73il@gmail.com>
Date: Wed Nov 22 17:48:52 2023 +0200
fs: factor out backing_file_{read,write}_iter() helpers
Overlayfs submits files io to backing files on other filesystems.
Factor out some common helpers to perform io to backing files, into
fs/backing-file.c.
Suggested-by: Miklos Szeredi <miklos@szeredi.hu>
Link: https://lore.kernel.org/r/CAJfpeguhmZbjP3JLqtUy0AdWaHOkAPWeP827BBWwRFEAUgnUcQ@mail.gmail.com
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
JIRA: https://issues.redhat.com/browse/RHEL-179443
CVE: CVE-2026-46054
commit f91a704f7161c2cf0fcd41fa9fbec4355b813fff
Author: Amir Goldstein <amir73il@gmail.com>
Date: Mon Oct 2 17:19:46 2023 +0300
fs: prepare for stackable filesystems backing file helpers
In preparation for factoring out some backing file io helpers from
overlayfs, move backing_file_open() into a new file fs/backing-file.c
and header.
Add a MAINTAINERS entry for stackable filesystems and add a Kconfig
FS_STACK which stackable filesystems need to select.
For now, the backing_file struct, the backing_file alloc/free functions
and the backing_file_real_path() accessor remain internal to file_table.c.
We may change that in the future.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Ondrej Mosnacek