Re: [RFC PATCH 1/2] mm: introduce MAP_FIXED_SAFE

[Florian Weimer]

On 11/20/2017 09:55 AM, Michal Hocko wrote:
> On Fri 17-11-17 08:30:48, Florian Weimer wrote:
> > On 11/16/2017 11:18 AM, Michal Hocko wrote:
> > > +	if (flags & MAP_FIXED_SAFE) {
> > > +		struct vm_area_struct *vma = find_vma(mm, addr);
> > > +
> > > +		if (vma && vma->vm_start <= addr)
> > > +			return -ENOMEM;
> > > +	}
> >
> > Could you pick a different error code which cannot also be caused by a an
> > unrelated, possibly temporary condition?  Maybe EBUSY or EEXIST?
>
> Hmm, none of those are described in the man page. I am usually very
> careful to not add new and potentially unexpected error codes but it is

I think this is a bad idea.  It leads to bizarre behavior, like open 
failing with EOVERFLOW with certain namespace configurations (which have 
nothing to do with file sizes).

Most of the manual pages are incomplete regarding error codes, and with 
seccomp filters and security modules, what error codes you actually get 
is anyone's guess.

> true that a new flag should warrant a new error code. I am not sure
> which one is more appropriate though. EBUSY suggests that retrying might
> help which is true only if some other party unmaps the range. So EEXIST
> would sound more natural.

Sure, EEXIST is completely fine.

> > This would definitely help with application-based randomization of mappings,
> > and there, actual ENOMEM and this error would have to be handled
> > differently.
>
> I see. Could you be more specific about the usecase you have in mind? I
> would incorporate it into the patch description.

glibc ld.so currently maps DSOs without hints.  This means that the 
kernel will map right next to each other, and the offsets between them a 
completely predictable.  We would like to change that and supply a 
random address in a window of the address space.  If there is a 
conflict, we do not want the kernel to pick a non-random address. 
Instead, we would try again with a random address.

Thanks,
Florian