Re: [PATCH 0/2] mm/memfd: handle GUP references reliably when write-sealing

[David Hildenbrand (Arm)]

On 11/3/26 19:31, David Hildenbrand (Arm) wrote:
> I spent way too much time on this, looking for better options. I think
> patch #1 fixes the most immediate issues but something like patch #2 is
> needed.
> 
> Long story short: someone can trigger a race such that we don't detect
> GUP references when write-sealing, allowing to modify content later.
> 
> Patch #1 handles pins reliably for folios with a pincount. Patch #2
> handles the remaining references, but can reject write-sealing with
> populated file mappings. vm.memfd_write_seal_mapped allows restoring the
> legacy behavior if needed.
> 
> All alternatives to patch #2 I tried ended up too complicated and nasty
> in corner cases. We should never have allowed write-sealing with
> existing file mappings.
> 
> Plenty of details in patch #2.
> 
> Did some testing on x86-64 without any surprises.
> 
> Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
> ---
> David Hildenbrand (Arm) (2):
>       mm/memfd: handle GUP pins more reliably when write-sealing
>       mm/memfd: handle GUP references reliably when write-sealing
> 
>  Documentation/admin-guide/sysctl/vm.rst | 21 +++++++++++++++
>  mm/memfd.c                              | 45 ++++++++++++++++++++++++++++++++-
>  2 files changed, 65 insertions(+), 1 deletion(-)

I think patch #1 is uncontroversial. It would be good to get some options on #2.
With the current infrastructure we have, I don't really see a good way to tackle
this differently.

I'd assume CRIU+write-sealed-memfd+mlock is rather the corner case ... :)

-- 
Cheers,

David