On Fri, 14 Aug 2026 07:53:28 +0900 Daehyeon Ko <[email protected]> wrote:
> Secretmem mappings are charged against RLIMIT_MEMLOCK and marked
> VM_LOCKED because their pages are unevictable and removed from the direct
> map.
>
> dup_mmap() clears VM_LOCKED on the child copy, but mremap() uses that
> flag to decide whether an expansion needs a memlock limit check and
> accounting. An unprivileged child can therefore expand an inherited
> secretmem VMA past its limit and populate the added range.
>
> Add a VMA open callback that marks secretmem copies without VM_LOCKED as
> VM_DONTEXPAND. dup_mmap() invokes the callback after clearing VM_LOCKED,
> while the original charged mapping retains its existing ability to grow
> within the limit.
Thanks.
> Add a selftest that verifies expansion of an inherited secretmem VMA is
> rejected.
And that's a nice touch.
> Fixes: 1507f51255c9 ("mm: introduce memfd_secret system call to create
> "secret" memory areas")
> Cc: [email protected]
AI review might have found what appears to be a related bug in there:
https://sashiko.dev/#/patchset/[email protected]
Do you think that's pertinent to your fix, or should it be addressed
separately?
