From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jann Horn Subject: Re: [PATCH] mmap.2: MAP_FIXED is okay if the address range has been reserved Date: Fri, 13 Apr 2018 18:17:36 +0200 Message-ID: References: <20180412153941.170849-1-jannh@google.com> <13801e2a-c44d-e940-f872-890a0612a483@nvidia.com> <9c714917-fc29-4d12-b5e8-cff28761a2c1@gmail.com> <20180413064917.GC17484@dhcp22.suse.cz> <20180413160435.GA17484@dhcp22.suse.cz> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Michal Hocko Cc: "Michael Kerrisk (man-pages)" , John Hubbard , linux-man , Andrew Morton , Linux-MM , lkml , Linux API List-Id: linux-man@vger.kernel.org On Fri, Apr 13, 2018 at 6:05 PM, Jann Horn wrote: > On Fri, Apr 13, 2018 at 6:04 PM, Michal Hocko wrote: >> On Fri 13-04-18 17:04:09, Jann Horn wrote: >>> On Fri, Apr 13, 2018 at 8:49 AM, Michal Hocko wrote: >>> > On Fri 13-04-18 08:43:27, Michael Kerrisk wrote: >>> > [...] >>> >> So, you mean remove this entire paragraph: >>> >> >>> >> For cases in which the specified memory region has not been >>> >> reserved using an existing mapping, newer kernels (Linux >>> >> 4.17 and later) provide an option MAP_FIXED_NOREPLACE that >>> >> should be used instead; older kernels require the caller to >>> >> use addr as a hint (without MAP_FIXED) and take appropriate >>> >> action if the kernel places the new mapping at a different >>> >> address. >>> >> >>> >> It seems like some version of the first half of the paragraph is worth >>> >> keeping, though, so as to point the reader in the direction of a remedy. >>> >> How about replacing that text with the following: >>> >> >>> >> Since Linux 4.17, the MAP_FIXED_NOREPLACE flag can be used >>> >> in a multithreaded program to avoid the hazard described >>> >> above. >>> > >>> > Yes, that sounds reasonable to me. >>> >>> But that kind of sounds as if you can't avoid it before Linux 4.17, >>> when actually, you just have to call mmap() with the address as hint, >>> and if mmap() returns a different address, munmap() it and go on your >>> normal error path. >> >> This is still racy in multithreaded application which is the main point >> of the whole section, no? > > No, it isn't. mmap() with a hint (without MAP_FIXED) will always non-racily allocate a memory region for you or return an error code. If it does allocate a memory region, it belongs to you until you deallocate it. It might be at a different address than you requested - in that case you can emulate MAP_FIXED_NOREPLACE by calling munmap() and treating it as an error; or you can do something else with it. MAP_FIXED_NOREPLACE is just a performance optimization.