Patch "userfaultfd: open userfaultfds with O_RDONLY" has been added to the 6.0-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    userfaultfd: open userfaultfds with O_RDONLY

to the 6.0-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     userfaultfd-open-userfaultfds-with-o_rdonly.patch
and it can be found in the queue-6.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 89de16ed4de5d674bcc12d82ecc05e060ea1f1f5
Author: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
Date:   Fri Jul 8 11:34:51 2022 +0200

    userfaultfd: open userfaultfds with O_RDONLY
    
    [ Upstream commit abec3d015fdfb7c63105c7e1c956188bf381aa55 ]
    
    Since userfaultfd doesn't implement a write operation, it is more
    appropriate to open it read-only.
    
    When userfaultfds are opened read-write like it is now, and such fd is
    passed from one process to another, SELinux will check both read and
    write permissions for the target process, even though it can't actually
    do any write operation on the fd later.
    
    Inspired by the following bug report, which has hit the SELinux scenario
    described above:
    https://bugzilla.redhat.com/show_bug.cgi?id=1974559
    
    Reported-by: Robert O'Callahan <roc@xxxxxxxxxxxxx>
    Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization")
    Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
    Acked-by: Peter Xu <peterx@xxxxxxxxxx>
    Acked-by: Christian Brauner (Microsoft) <brauner@xxxxxxxxxx>
    Signed-off-by: Paul Moore <paul@xxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 175de70e3adf..0c1d33c4f74c 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -991,7 +991,7 @@ static int resolve_userfault_fork(struct userfaultfd_ctx *new,
 	int fd;
 
 	fd = anon_inode_getfd_secure("[userfaultfd]", &userfaultfd_fops, new,
-			O_RDWR | (new->flags & UFFD_SHARED_FCNTL_FLAGS), inode);
+			O_RDONLY | (new->flags & UFFD_SHARED_FCNTL_FLAGS), inode);
 	if (fd < 0)
 		return fd;
 
@@ -2094,7 +2094,7 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)
 	mmgrab(ctx->mm);
 
 	fd = anon_inode_getfd_secure("[userfaultfd]", &userfaultfd_fops, ctx,
-			O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL);
+			O_RDONLY | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL);
 	if (fd < 0) {
 		mmdrop(ctx->mm);
 		kmem_cache_free(userfaultfd_ctx_cachep, ctx);