Re: [PATCH] mm/secretmem: prevent uncharged mremap expansion after fork

On Fri, 14 Aug 2026 07:53:28 +0900 Daehyeon Ko <[email protected]> wrote:

> Secretmem mappings are charged against RLIMIT_MEMLOCK and marked
> VM_LOCKED because their pages are unevictable and removed from the direct
> map.
> 
> dup_mmap() clears VM_LOCKED on the child copy, but mremap() uses that
> flag to decide whether an expansion needs a memlock limit check and
> accounting. An unprivileged child can therefore expand an inherited
> secretmem VMA past its limit and populate the added range.
> 
> Add a VMA open callback that marks secretmem copies without VM_LOCKED as
> VM_DONTEXPAND. dup_mmap() invokes the callback after clearing VM_LOCKED,
> while the original charged mapping retains its existing ability to grow
> within the limit.

Thanks.

> Add a selftest that verifies expansion of an inherited secretmem VMA is
> rejected.

And that's a nice touch.

> Fixes: 1507f51255c9 ("mm: introduce memfd_secret system call to create "secret" memory areas")
> Cc: [email protected]

AI review might have found what appears to be a related bug in there:
	https://sashiko.dev/#/patchset/[email protected]

Do you think that's pertinent to your fix, or should it be addressed
separately?