Re: [RFC PATCH 4/6] mm/memfd_luo: allow preserving a tmpfs mount

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] mm: tmpfs LUO drops group quotas due to incomplete USRQUOTA check
- [Medium] mm: TOCTOU race allows unsupported ID mappings and quotas to bypass LUO validation
--

commit 20e62ff0b162f0ffc76cd0d972cc6c760a83d003
Author: Pratyush Yadav (Google) <pratyush@xxxxxxxxxx>

mm/memfd_luo: allow preserving a tmpfs mount

This commit adds support for preserving a tmpfs mount across a live update.
It preserves the filesystem block limit and root directory mode, while
resetting other options to default, identifying the mount via a file
pointing to it.

> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
> --- a/mm/memfd_luo.c
> +++ b/mm/memfd_luo.c
[ ... ]
> +static bool tmpfs_luo_mnt_can_preserve(struct liveupdate_file_handler *fh,
> +				       struct file *file)
> +{
[ ... ]
> +	/* These features are not supported. */
> +	if (SHMEM_SB(sb)->mpol || sb_has_quota_active(sb, USRQUOTA) ||
> +	    sb_has_encoding(sb) || is_idmapped_mnt(mnt))
> +		return false;

[Severity: Medium]
Does this condition improperly accept tmpfs mounts with group or project
quotas active? 

The check only tests for USRQUOTA, which means mounts with grpquota or 
prjquota will bypass this rejection and their quota state will be silently
lost across kexec. 

Should this use sb_any_quota_loaded(sb) to properly detect all quota types?

[ ... ]
> +static int tmpfs_luo_mnt_freeze(struct liveupdate_file_op_args *args)
> +{
> +	struct super_block *sb = args->file->f_path.mnt->mnt_sb;
> +	struct shmem_sb_info *sbinfo = SHMEM_SB(sb);
> +	struct tmpfs_luo_mnt_ser *ser;
> +
> +	/*
> +	 * A remount can install a memory policy after can_preserve() accepted
> +	 * the mount.
> +	 */
> +	if (sbinfo->mpol)
> +		return -EOPNOTSUPP;

[Severity: Medium]
Does this leave a TOCTOU window for ID mappings and quotas? 

While mpol is re-validated here to handle concurrent remounts, checks for
is_idmapped_mnt() and quotas are missing. If a user concurrently adds an ID
mapping via mount_setattr() or enables quotas via remount after the
tmpfs_luo_mnt_can_preserve() check passes, those unsupported properties will
bypass validation and be silently dropped across kexec.

Should this re-validate the ID mapping and quota state as well?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923224408.3745689-1-pratyush@xxxxxxxxxx?part=4