[PATCH 0/2] mm/memfd: handle GUP references reliably when write-sealing

[David Hildenbrand (Arm)]

I spent way too much time on this, looking for better options. I think
patch #1 fixes the most immediate issues but something like patch #2 is
needed.

Long story short: someone can trigger a race such that we don't detect
GUP references when write-sealing, allowing to modify content later.

Patch #1 handles pins reliably for folios with a pincount. Patch #2
handles the remaining references, but can reject write-sealing with
populated file mappings. vm.memfd_write_seal_mapped allows restoring the
legacy behavior if needed.

All alternatives to patch #2 I tried ended up too complicated and nasty
in corner cases. We should never have allowed write-sealing with
existing file mappings.

Plenty of details in patch #2.

Did some testing on x86-64 without any surprises.

Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
---
David Hildenbrand (Arm) (2):
      mm/memfd: handle GUP pins more reliably when write-sealing
      mm/memfd: handle GUP references reliably when write-sealing

 Documentation/admin-guide/sysctl/vm.rst | 21 +++++++++++++++
 mm/memfd.c                              | 45 ++++++++++++++++++++++++++++++++-
 2 files changed, 65 insertions(+), 1 deletion(-)

---

base-commit: 462595652740dc45f2392dc59d9609e509ee60af

change-id: 20261102-fixes_core_2-39e59afda919

--

Cheers,

David