From: Joel Fernandes <joel@joelfernandes.org>
To: linux-kernel@vger.kernel.org, hch@infradead.org
Cc: jreck@google.com, john.stultz@linaro.org, tkjos@google.com,
gregkh@linuxfoundation.org, "Al Viro" <viro@zeniv.linux.org.uk>,
"Andrew Morton" <akpm@linux-foundation.org>,
dancol@google.com, "J. Bruce Fields" <bfields@fieldses.org>,
"Jeff Layton" <jlayton@kernel.org>,
"Khalid Aziz" <khalid.aziz@oracle.com>,
"Lei Yang" <Lei.Yang@windriver.com>,
linux-fsdevel@vger.kernel.org, linux-kselftest@vger.kernel.org,
linux-mm@kvack.org,
"Marc-André Lureau" <marcandre.lureau@redhat.com>,
"Mike Kravetz" <mike.kravetz@oracle.com>,
minchan@kernel.org, "Shuah Khan" <shuah@kernel.org>,
valdis.kletnieks@vt.edu
Subject: Re: [PATCH v3 resend 1/2] mm: Add an F_SEAL_FUTURE_WRITE seal to memfd
Date: Fri, 9 Nov 2018 00:49:28 -0800 [thread overview]
Message-ID: <20181109084928.GA37614@google.com> (raw)
In-Reply-To: <20181108041537.39694-1-joel@joelfernandes.org>
On Wed, Nov 07, 2018 at 08:15:36PM -0800, Joel Fernandes (Google) wrote:
> Android uses ashmem for sharing memory regions. We are looking forward
> to migrating all usecases of ashmem to memfd so that we can possibly
> remove the ashmem driver in the future from staging while also
> benefiting from using memfd and contributing to it. Note staging drivers
> are also not ABI and generally can be removed at anytime.
>
> One of the main usecases Android has is the ability to create a region
> and mmap it as writeable, then add protection against making any
> "future" writes while keeping the existing already mmap'ed
> writeable-region active. This allows us to implement a usecase where
> receivers of the shared memory buffer can get a read-only view, while
> the sender continues to write to the buffer.
> See CursorWindow documentation in Android for more details:
> https://developer.android.com/reference/android/database/CursorWindow
>
> This usecase cannot be implemented with the existing F_SEAL_WRITE seal.
> To support the usecase, this patch adds a new F_SEAL_FUTURE_WRITE seal
> which prevents any future mmap and write syscalls from succeeding while
> keeping the existing mmap active. The following program shows the seal
> working in action:
>
[...]
> The output of running this program is as follows:
> ret=3
> map 0 passed
> write passed
> map 1 prot-write passed as expected
> future-write seal now active
> write failed as expected due to future-write seal
> map 2 prot-write failed as expected due to seal
> : Permission denied
> map 3 prot-read passed as expected
>
> Cc: jreck@google.com
> Cc: john.stultz@linaro.org
> Cc: tkjos@google.com
> Cc: gregkh@linuxfoundation.org
> Cc: hch@infradead.org
> Reviewed-by: John Stultz <john.stultz@linaro.org>
> Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
> ---
> v1->v2: No change, just added selftests to the series. manpages are
> ready and I'll submit them once the patches are accepted.
>
> v2->v3: Updated commit message to have more support code (John Stultz)
> Renamed seal from F_SEAL_FS_WRITE to F_SEAL_FUTURE_WRITE
> (Christoph Hellwig)
> Allow for this seal only if grow/shrink seals are also
> either previous set, or are requested along with this seal.
> (Christoph Hellwig)
> Added locking to synchronize access to file->f_mode.
> (Christoph Hellwig)
Christoph, do the patches look Ok to you now? If so, then could you give an
Acked-by or Reviewed-by tag?
Thanks a lot,
- Joel
> include/uapi/linux/fcntl.h | 1 +
> mm/memfd.c | 22 +++++++++++++++++++++-
> 2 files changed, 22 insertions(+), 1 deletion(-)
>
> diff --git a/include/uapi/linux/fcntl.h b/include/uapi/linux/fcntl.h
> index 6448cdd9a350..a2f8658f1c55 100644
> --- a/include/uapi/linux/fcntl.h
> +++ b/include/uapi/linux/fcntl.h
> @@ -41,6 +41,7 @@
> #define F_SEAL_SHRINK 0x0002 /* prevent file from shrinking */
> #define F_SEAL_GROW 0x0004 /* prevent file from growing */
> #define F_SEAL_WRITE 0x0008 /* prevent writes */
> +#define F_SEAL_FUTURE_WRITE 0x0010 /* prevent future writes while mapped */
> /* (1U << 31) is reserved for signed error codes */
>
> /*
> diff --git a/mm/memfd.c b/mm/memfd.c
> index 2bb5e257080e..5ba9804e9515 100644
> --- a/mm/memfd.c
> +++ b/mm/memfd.c
> @@ -150,7 +150,8 @@ static unsigned int *memfd_file_seals_ptr(struct file *file)
> #define F_ALL_SEALS (F_SEAL_SEAL | \
> F_SEAL_SHRINK | \
> F_SEAL_GROW | \
> - F_SEAL_WRITE)
> + F_SEAL_WRITE | \
> + F_SEAL_FUTURE_WRITE)
>
> static int memfd_add_seals(struct file *file, unsigned int seals)
> {
> @@ -219,6 +220,25 @@ static int memfd_add_seals(struct file *file, unsigned int seals)
> }
> }
>
> + if ((seals & F_SEAL_FUTURE_WRITE) &&
> + !(*file_seals & F_SEAL_FUTURE_WRITE)) {
> + /*
> + * The FUTURE_WRITE seal also prevents growing and shrinking
> + * so we need them to be already set, or requested now.
> + */
> + int test_seals = (seals | *file_seals) &
> + (F_SEAL_GROW | F_SEAL_SHRINK);
> +
> + if (test_seals != (F_SEAL_GROW | F_SEAL_SHRINK)) {
> + error = -EINVAL;
> + goto unlock;
> + }
> +
> + spin_lock(&file->f_lock);
> + file->f_mode &= ~(FMODE_WRITE | FMODE_PWRITE);
> + spin_unlock(&file->f_lock);
> + }
> +
> *file_seals |= seals;
> error = 0;
>
> --
> 2.19.1.930.g4563a0d9d0-goog
next prev parent reply other threads:[~2018-11-09 8:49 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-08 4:15 [PATCH v3 resend 1/2] mm: Add an F_SEAL_FUTURE_WRITE seal to memfd Joel Fernandes (Google)
2018-11-08 4:15 ` [PATCH v3 resend 2/2] selftests/memfd: Add tests for F_SEAL_FUTURE_WRITE seal Joel Fernandes (Google)
2018-11-09 8:49 ` Joel Fernandes [this message]
2018-11-09 20:36 ` [PATCH v3 resend 1/2] mm: Add an F_SEAL_FUTURE_WRITE seal to memfd Andrew Morton
2018-11-10 3:54 ` Joel Fernandes
2018-11-09 21:06 ` Jann Horn
2018-11-09 21:19 ` Jann Horn
2018-11-10 3:20 ` Joel Fernandes
2018-11-10 6:05 ` Andy Lutomirski
2018-11-10 18:24 ` Joel Fernandes
2018-11-10 18:45 ` Daniel Colascione
2018-11-10 19:11 ` Daniel Colascione
2018-11-10 19:55 ` Andy Lutomirski
2018-11-10 22:09 ` Joel Fernandes
2018-11-10 22:18 ` Andy Lutomirski
2018-11-11 2:38 ` Joel Fernandes
2018-11-11 3:40 ` Andy Lutomirski
2018-11-11 4:01 ` Joel Fernandes
2018-11-11 8:09 ` Joel Fernandes
2018-11-11 8:30 ` Daniel Colascione
2018-11-11 15:14 ` Andy Lutomirski
2018-11-11 17:36 ` Joel Fernandes
2018-11-10 12:26 ` Daniel Colascione
2018-11-10 17:10 ` Joel Fernandes
2018-11-09 21:40 ` Andy Lutomirski
2018-11-09 20:02 ` Michael Tirado
2018-11-10 1:49 ` Joel Fernandes
2018-11-09 22:20 ` Daniel Colascione
2018-11-09 22:37 ` Andy Lutomirski
2018-11-09 22:42 ` Daniel Colascione
2018-11-09 23:14 ` Andy Lutomirski
2018-11-10 1:36 ` Joel Fernandes
2018-11-09 23:46 ` Joel Fernandes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181109084928.GA37614@google.com \
--to=joel@joelfernandes.org \
--cc=Lei.Yang@windriver.com \
--cc=akpm@linux-foundation.org \
--cc=bfields@fieldses.org \
--cc=dancol@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=hch@infradead.org \
--cc=jlayton@kernel.org \
--cc=john.stultz@linaro.org \
--cc=jreck@google.com \
--cc=khalid.aziz@oracle.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=marcandre.lureau@redhat.com \
--cc=mike.kravetz@oracle.com \
--cc=minchan@kernel.org \
--cc=shuah@kernel.org \
--cc=tkjos@google.com \
--cc=valdis.kletnieks@vt.edu \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).