[PATCH 0/3] mm: memfd_luo hotfixes

[PATCH 0/3] mm: memfd_luo hotfixes

[Pratyush Yadav]

From: "Pratyush Yadav (Google)" <pratyush@kernel.org>

Hi,

This series contains a couple of fixes for memfd preservation using LUO.
Patch 1 is a preparatory patch for patch 2. Patch 2 sets up the right
flags on the file and makes sure security hooks are called. Patch 3
fixes a small memory leak in the error path.

Andrew, it would be great if we can land these in v6.19, especially
patches 1 and 2 since they fix a usability and a security problem. Patch
3 can wait, but then it is pretty simple too. Anyway, since it is pretty
late in the cycle, I'll leave it to your judgement.

Regards,
Pratyush Yadav

Pratyush Yadav (Google) (3):
  memfd: export alloc_file()
  mm: memfd_luo: use memfd_alloc_file() instead of shmem_file_setup()
  mm: memfd_luo: restore and free memfd_luo_ser on failure

 include/linux/memfd.h |  6 ++++++
 mm/memfd.c            |  4 ++--
 mm/memfd_luo.c        | 10 ++++++----
 3 files changed, 14 insertions(+), 6 deletions(-)


base-commit: 1ac8a55c76e78fc4fc406fd7bd872d0127d04feb
-- 
2.52.0.457.g6b5491de43-goog

[PATCH 1/3] memfd: export alloc_file()

[Pratyush Yadav]

From: "Pratyush Yadav (Google)" <pratyush@kernel.org>

The Live Update Orchestrator's (LUO) memfd preservation works by
preserving all the folios of a memfd, re-creating an empty memfd on the
next boot, and then inserting back the preserved folios.

Currently it creates the file by directly calling shmem_file_setup().
This leaves out other work done by alloc_file() like setting up the file
mode, flags, or calling the security hooks.

Export alloc_file() to let memfd_luo use it. Rename it to
memfd_alloc_file() since it is no longer private and thus needs a
subsystem prefix.

Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
---
 include/linux/memfd.h | 6 ++++++
 mm/memfd.c            | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/include/linux/memfd.h b/include/linux/memfd.h
index cc74de3dbcfe..c328a7b356d0 100644
--- a/include/linux/memfd.h
+++ b/include/linux/memfd.h
@@ -17,6 +17,7 @@ struct folio *memfd_alloc_folio(struct file *memfd, pgoff_t idx);
  * to by vm_flags_ptr.
  */
 int memfd_check_seals_mmap(struct file *file, vm_flags_t *vm_flags_ptr);
+struct file *memfd_alloc_file(const char *name, unsigned int flags);
 #else
 static inline long memfd_fcntl(struct file *f, unsigned int c, unsigned int a)
 {
@@ -31,6 +32,11 @@ static inline int memfd_check_seals_mmap(struct file *file,
 {
 	return 0;
 }
+
+static inline struct file *memfd_alloc_file(const char *name, unsigned int flags)
+{
+	return ERR_PTR(-EINVAL);
+}
 #endif
 
 #endif /* __LINUX_MEMFD_H */
diff --git a/mm/memfd.c b/mm/memfd.c
index ab5312aff14b..f032c6052926 100644
--- a/mm/memfd.c
+++ b/mm/memfd.c
@@ -456,7 +456,7 @@ static char *alloc_name(const char __user *uname)
 	return ERR_PTR(error);
 }
 
-static struct file *alloc_file(const char *name, unsigned int flags)
+struct file *memfd_alloc_file(const char *name, unsigned int flags)
 {
 	unsigned int *file_seals;
 	struct file *file;
@@ -520,5 +520,5 @@ SYSCALL_DEFINE2(memfd_create,
 		return PTR_ERR(name);
 
 	fd_flags = (flags & MFD_CLOEXEC) ? O_CLOEXEC : 0;
-	return FD_ADD(fd_flags, alloc_file(name, flags));
+	return FD_ADD(fd_flags, memfd_alloc_file(name, flags));
 }
-- 
2.52.0.457.g6b5491de43-goog

[PATCH 2/3] mm: memfd_luo: use memfd_alloc_file() instead of shmem_file_setup()

[Pratyush Yadav]

From: "Pratyush Yadav (Google)" <pratyush@kernel.org>

When restoring a memfd, the file is created using shmem_file_setup().
While memfd creation also calls this function to get the file, it also
does other things:

  1. The O_LARGEFILE flag is set on the file. If this is not done,
  writes on the memfd exceeding 2 GiB fail.

  2. FMODE_LSEEK, FMODE_PREAD, and FMODE_PWRITE are set on the file.
  This makes sure the file is seekable and can be used with pread() and
  pwrite().

  3. Initializes the security field for the inode and makes sure that
  inode creation is permitted by the security module.

Currently, none of those things are done. This means writes above 2 GiB
fail, pread(), and pwrite() fail, and so on. lseek() happens to work
because file_init_path() sets it because shmem defines fop->llseek.

Fix this by using memfd_alloc_file() to get the file to make sure the
initialization sequence for normal and preserved memfd is the same.

Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
---
 mm/memfd_luo.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
index 4f6ba63b4310..01a72e4d3ef6 100644
--- a/mm/memfd_luo.c
+++ b/mm/memfd_luo.c
@@ -78,6 +78,7 @@
 #include <linux/liveupdate.h>
 #include <linux/shmem_fs.h>
 #include <linux/vmalloc.h>
+#include <linux/memfd.h>
 #include "internal.h"
 
 static int memfd_luo_preserve_folios(struct file *file,
@@ -443,8 +444,7 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
 	if (!ser)
 		return -EINVAL;
 
-	file = shmem_file_setup("", 0, VM_NORESERVE);
-
+	file = memfd_alloc_file("", 0);
 	if (IS_ERR(file)) {
 		pr_err("failed to setup file: %pe\n", file);
 		return PTR_ERR(file);
-- 
2.52.0.457.g6b5491de43-goog

[PATCH 3/3] mm: memfd_luo: restore and free memfd_luo_ser on failure

[Pratyush Yadav]

From: "Pratyush Yadav (Google)" <pratyush@kernel.org>

memfd_luo_ser has the serialization metadata. It is of no use once
restoration fails. Free it on failure.

Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
---
 mm/memfd_luo.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
index 01a72e4d3ef6..a34fccc23b6a 100644
--- a/mm/memfd_luo.c
+++ b/mm/memfd_luo.c
@@ -447,7 +447,8 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
 	file = memfd_alloc_file("", 0);
 	if (IS_ERR(file)) {
 		pr_err("failed to setup file: %pe\n", file);
-		return PTR_ERR(file);
+		err = PTR_ERR(file);
+		goto free_ser;
 	}
 
 	vfs_setpos(file, ser->pos, MAX_LFS_FILESIZE);
@@ -473,7 +474,8 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
 
 put_file:
 	fput(file);
-
+free_ser:
+	kho_restore_free(ser);
 	return err;
 }
 
-- 
2.52.0.457.g6b5491de43-goog

Re: [PATCH 0/3] mm: memfd_luo hotfixes

[Andrew Morton]

On Thu, 22 Jan 2026 16:18:38 +0100 Pratyush Yadav <pratyush@kernel.org> wrote:

> From: "Pratyush Yadav (Google)" <pratyush@kernel.org>
> 
> Hi,
> 
> This series contains a couple of fixes for memfd preservation using LUO.

Good stuff.

> Andrew, it would be great if we can land these in v6.19, especially
> patches 1 and 2 since they fix a usability and a security problem. Patch
> 3 can wait, but then it is pretty simple too.

Absolutely.  Patches which fix material which was added in the current
cycle get the red carpet treatment.

Re: [PATCH 1/3] memfd: export alloc_file()

[Mike Rapoport]

On Thu, Jan 22, 2026 at 04:18:39PM +0100, Pratyush Yadav wrote:
> From: "Pratyush Yadav (Google)" <pratyush@kernel.org>
> 
> The Live Update Orchestrator's (LUO) memfd preservation works by
> preserving all the folios of a memfd, re-creating an empty memfd on the
> next boot, and then inserting back the preserved folios.
> 
> Currently it creates the file by directly calling shmem_file_setup().
> This leaves out other work done by alloc_file() like setting up the file
> mode, flags, or calling the security hooks.
> 
> Export alloc_file() to let memfd_luo use it. Rename it to
> memfd_alloc_file() since it is no longer private and thus needs a
> subsystem prefix.
> 
> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>

Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

-- 
Sincerely yours,
Mike.

Re: [PATCH 2/3] mm: memfd_luo: use memfd_alloc_file() instead of shmem_file_setup()

[Mike Rapoport]

On Thu, Jan 22, 2026 at 04:18:40PM +0100, Pratyush Yadav wrote:
> From: "Pratyush Yadav (Google)" <pratyush@kernel.org>
> 
> When restoring a memfd, the file is created using shmem_file_setup().
> While memfd creation also calls this function to get the file, it also
> does other things:
> 
>   1. The O_LARGEFILE flag is set on the file. If this is not done,
>   writes on the memfd exceeding 2 GiB fail.
> 
>   2. FMODE_LSEEK, FMODE_PREAD, and FMODE_PWRITE are set on the file.
>   This makes sure the file is seekable and can be used with pread() and
>   pwrite().
> 
>   3. Initializes the security field for the inode and makes sure that
>   inode creation is permitted by the security module.
> 
> Currently, none of those things are done. This means writes above 2 GiB
> fail, pread(), and pwrite() fail, and so on. lseek() happens to work
> because file_init_path() sets it because shmem defines fop->llseek.
> 
> Fix this by using memfd_alloc_file() to get the file to make sure the
> initialization sequence for normal and preserved memfd is the same.
> 
> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>

Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

> ---
>  mm/memfd_luo.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
> index 4f6ba63b4310..01a72e4d3ef6 100644
> --- a/mm/memfd_luo.c
> +++ b/mm/memfd_luo.c
> @@ -78,6 +78,7 @@
>  #include <linux/liveupdate.h>
>  #include <linux/shmem_fs.h>
>  #include <linux/vmalloc.h>
> +#include <linux/memfd.h>
>  #include "internal.h"
>  
>  static int memfd_luo_preserve_folios(struct file *file,
> @@ -443,8 +444,7 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
>  	if (!ser)
>  		return -EINVAL;
>  
> -	file = shmem_file_setup("", 0, VM_NORESERVE);
> -
> +	file = memfd_alloc_file("", 0);
>  	if (IS_ERR(file)) {
>  		pr_err("failed to setup file: %pe\n", file);
>  		return PTR_ERR(file);
> -- 
> 2.52.0.457.g6b5491de43-goog
> 

-- 
Sincerely yours,
Mike.

Re: [PATCH 3/3] mm: memfd_luo: restore and free memfd_luo_ser on failure

[Mike Rapoport]

On Thu, Jan 22, 2026 at 04:18:41PM +0100, Pratyush Yadav wrote:
> From: "Pratyush Yadav (Google)" <pratyush@kernel.org>
> 
> memfd_luo_ser has the serialization metadata. It is of no use once
> restoration fails. Free it on failure.
> 
> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>

Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

-- 
Sincerely yours,
Mike.

Re: [PATCH 1/3] memfd: export alloc_file()

[Pasha Tatashin]

> ---
>  include/linux/memfd.h | 6 ++++++
>  mm/memfd.c            | 4 ++--
>  2 files changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/include/linux/memfd.h b/include/linux/memfd.h
> index cc74de3dbcfe..c328a7b356d0 100644
> --- a/include/linux/memfd.h
> +++ b/include/linux/memfd.h
> @@ -17,6 +17,7 @@ struct folio *memfd_alloc_folio(struct file *memfd, pgoff_t idx);
>   * to by vm_flags_ptr.
>   */
>  int memfd_check_seals_mmap(struct file *file, vm_flags_t *vm_flags_ptr);
> +struct file *memfd_alloc_file(const char *name, unsigned int flags);
>  #else
>  static inline long memfd_fcntl(struct file *f, unsigned int c, unsigned int a)
>  {
> @@ -31,6 +32,11 @@ static inline int memfd_check_seals_mmap(struct file *file,
>  {
>         return 0;
>  }
> +
> +static inline struct file *memfd_alloc_file(const char *name, unsigned int flags)
> +{
> +       return ERR_PTR(-EINVAL);
> +}
>  #endif
>
>  #endif /* __LINUX_MEMFD_H */
> diff --git a/mm/memfd.c b/mm/memfd.c
> index ab5312aff14b..f032c6052926 100644
> --- a/mm/memfd.c
> +++ b/mm/memfd.c
> @@ -456,7 +456,7 @@ static char *alloc_name(const char __user *uname)
>         return ERR_PTR(error);
>  }
>
> -static struct file *alloc_file(const char *name, unsigned int flags)
> +struct file *memfd_alloc_file(const char *name, unsigned int flags)
>  {
>         unsigned int *file_seals;
>         struct file *file;
> @@ -520,5 +520,5 @@ SYSCALL_DEFINE2(memfd_create,
>                 return PTR_ERR(name);
>
>         fd_flags = (flags & MFD_CLOEXEC) ? O_CLOEXEC : 0;
> -       return FD_ADD(fd_flags, alloc_file(name, flags));
> +       return FD_ADD(fd_flags, memfd_alloc_file(name, flags));
>  }

Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>

Re: [PATCH 2/3] mm: memfd_luo: use memfd_alloc_file() instead of shmem_file_setup()

[Pasha Tatashin]

On Thu, Jan 22, 2026 at 10:19 AM Pratyush Yadav <pratyush@kernel.org> wrote:
>
> From: "Pratyush Yadav (Google)" <pratyush@kernel.org>
>
> When restoring a memfd, the file is created using shmem_file_setup().
> While memfd creation also calls this function to get the file, it also
> does other things:
>
>   1. The O_LARGEFILE flag is set on the file. If this is not done,
>   writes on the memfd exceeding 2 GiB fail.
>
>   2. FMODE_LSEEK, FMODE_PREAD, and FMODE_PWRITE are set on the file.
>   This makes sure the file is seekable and can be used with pread() and
>   pwrite().
>
>   3. Initializes the security field for the inode and makes sure that
>   inode creation is permitted by the security module.
>
> Currently, none of those things are done. This means writes above 2 GiB
> fail, pread(), and pwrite() fail, and so on. lseek() happens to work
> because file_init_path() sets it because shmem defines fop->llseek.
>
> Fix this by using memfd_alloc_file() to get the file to make sure the
> initialization sequence for normal and preserved memfd is the same.
>
> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
> ---
>  mm/memfd_luo.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
> index 4f6ba63b4310..01a72e4d3ef6 100644
> --- a/mm/memfd_luo.c
> +++ b/mm/memfd_luo.c
> @@ -78,6 +78,7 @@
>  #include <linux/liveupdate.h>
>  #include <linux/shmem_fs.h>
>  #include <linux/vmalloc.h>
> +#include <linux/memfd.h>
>  #include "internal.h"
>
>  static int memfd_luo_preserve_folios(struct file *file,
> @@ -443,8 +444,7 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
>         if (!ser)
>                 return -EINVAL;
>
> -       file = shmem_file_setup("", 0, VM_NORESERVE);
> -
> +       file = memfd_alloc_file("", 0);


Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>

Re: [PATCH 3/3] mm: memfd_luo: restore and free memfd_luo_ser on failure

[Pasha Tatashin]

> ---
>  mm/memfd_luo.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
> index 01a72e4d3ef6..a34fccc23b6a 100644
> --- a/mm/memfd_luo.c
> +++ b/mm/memfd_luo.c
> @@ -447,7 +447,8 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
>         file = memfd_alloc_file("", 0);
>         if (IS_ERR(file)) {
>                 pr_err("failed to setup file: %pe\n", file);
> -               return PTR_ERR(file);
> +               err = PTR_ERR(file);
> +               goto free_ser;
>         }
>
>         vfs_setpos(file, ser->pos, MAX_LFS_FILESIZE);
> @@ -473,7 +474,8 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
>
>  put_file:
>         fput(file);
> -
> +free_ser:
> +       kho_restore_free(ser);

Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>