mm: introduce MAP_SHARED_VALIDATE, a mechanism to safely define new mmap flags
The mmap(2) syscall suffers from the ABI anti-pattern of not validating unknown flags. However, proposals like MAP_SYNC need a mechanism to define new behavior that is known to fail on older kernels without the support. Define a new MAP_SHARED_VALIDATE flag pattern that is guaranteed to fail on all legacy mmap implementations. It is worth noting that the original proposal was for a standalone MAP_VALIDATE flag. However, when that could not be supported by all archs Linus observed: I see why you *think* you want a bitmap. You think you want a bitmap because you want to make MAP_VALIDATE be part of MAP_SYNC etc, so that people can do ret = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_SYNC, fd, 0); and "know" that MAP_SYNC actually takes. And I'm saying that whole wish is bogus. You're fundamentally depending on special semantics, just make it explicit. It's already not portable, so don't try to make it so. Rename that MAP_VALIDATE as MAP_SHARED_VALIDATE, make it have a value of 0x3, and make people do ret = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED_VALIDATE | MAP_SYNC, fd, 0); and then the kernel side is easier too (none of that random garbage playing games with looking at the "MAP_VALIDATE bit", but just another case statement in that map type thing. Boom. Done. Similar to ->fallocate() we also want the ability to validate the support for new flags on a per ->mmap() 'struct file_operations' instance basis. Towards that end arrange for flags to be generically validated against a mmap_supported_flags exported by 'struct file_operations'. By default all existing flags are implicitly supported, but new flags require MAP_SHARED_VALIDATE and per-instance-opt-in. Cc: Jan Kara <jack@suse.cz> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Andy Lutomirski <luto@kernel.org> Cc: Andrew Morton <akpm@linux-foundation.org> Suggested-by: Christoph Hellwig <hch@lst.de> Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Reviewed-by: Ross Zwisler <ross.zwisler@linux.intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
This commit is contained in:
parent
592e254502
commit
1c97259740
|
@ -11,6 +11,7 @@
|
||||||
|
|
||||||
#define MAP_SHARED 0x01 /* Share changes */
|
#define MAP_SHARED 0x01 /* Share changes */
|
||||||
#define MAP_PRIVATE 0x02 /* Changes are private */
|
#define MAP_PRIVATE 0x02 /* Changes are private */
|
||||||
|
#define MAP_SHARED_VALIDATE 0x03 /* share + validate extension flags */
|
||||||
#define MAP_TYPE 0x0f /* Mask for type of mapping (OSF/1 is _wrong_) */
|
#define MAP_TYPE 0x0f /* Mask for type of mapping (OSF/1 is _wrong_) */
|
||||||
#define MAP_FIXED 0x100 /* Interpret addr exactly */
|
#define MAP_FIXED 0x100 /* Interpret addr exactly */
|
||||||
#define MAP_ANONYMOUS 0x10 /* don't use a file */
|
#define MAP_ANONYMOUS 0x10 /* don't use a file */
|
||||||
|
|
|
@ -28,6 +28,7 @@
|
||||||
*/
|
*/
|
||||||
#define MAP_SHARED 0x001 /* Share changes */
|
#define MAP_SHARED 0x001 /* Share changes */
|
||||||
#define MAP_PRIVATE 0x002 /* Changes are private */
|
#define MAP_PRIVATE 0x002 /* Changes are private */
|
||||||
|
#define MAP_SHARED_VALIDATE 0x003 /* share + validate extension flags */
|
||||||
#define MAP_TYPE 0x00f /* Mask for type of mapping */
|
#define MAP_TYPE 0x00f /* Mask for type of mapping */
|
||||||
#define MAP_FIXED 0x010 /* Interpret addr exactly */
|
#define MAP_FIXED 0x010 /* Interpret addr exactly */
|
||||||
|
|
||||||
|
|
|
@ -11,6 +11,7 @@
|
||||||
|
|
||||||
#define MAP_SHARED 0x01 /* Share changes */
|
#define MAP_SHARED 0x01 /* Share changes */
|
||||||
#define MAP_PRIVATE 0x02 /* Changes are private */
|
#define MAP_PRIVATE 0x02 /* Changes are private */
|
||||||
|
#define MAP_SHARED_VALIDATE 0x03 /* share + validate extension flags */
|
||||||
#define MAP_TYPE 0x03 /* Mask for type of mapping */
|
#define MAP_TYPE 0x03 /* Mask for type of mapping */
|
||||||
#define MAP_FIXED 0x04 /* Interpret addr exactly */
|
#define MAP_FIXED 0x04 /* Interpret addr exactly */
|
||||||
#define MAP_ANONYMOUS 0x10 /* don't use a file */
|
#define MAP_ANONYMOUS 0x10 /* don't use a file */
|
||||||
|
|
|
@ -35,6 +35,7 @@
|
||||||
*/
|
*/
|
||||||
#define MAP_SHARED 0x001 /* Share changes */
|
#define MAP_SHARED 0x001 /* Share changes */
|
||||||
#define MAP_PRIVATE 0x002 /* Changes are private */
|
#define MAP_PRIVATE 0x002 /* Changes are private */
|
||||||
|
#define MAP_SHARED_VALIDATE 0x003 /* share + validate extension flags */
|
||||||
#define MAP_TYPE 0x00f /* Mask for type of mapping */
|
#define MAP_TYPE 0x00f /* Mask for type of mapping */
|
||||||
#define MAP_FIXED 0x010 /* Interpret addr exactly */
|
#define MAP_FIXED 0x010 /* Interpret addr exactly */
|
||||||
|
|
||||||
|
|
|
@ -1701,6 +1701,7 @@ struct file_operations {
|
||||||
long (*unlocked_ioctl) (struct file *, unsigned int, unsigned long);
|
long (*unlocked_ioctl) (struct file *, unsigned int, unsigned long);
|
||||||
long (*compat_ioctl) (struct file *, unsigned int, unsigned long);
|
long (*compat_ioctl) (struct file *, unsigned int, unsigned long);
|
||||||
int (*mmap) (struct file *, struct vm_area_struct *);
|
int (*mmap) (struct file *, struct vm_area_struct *);
|
||||||
|
unsigned long mmap_supported_flags;
|
||||||
int (*open) (struct inode *, struct file *);
|
int (*open) (struct inode *, struct file *);
|
||||||
int (*flush) (struct file *, fl_owner_t id);
|
int (*flush) (struct file *, fl_owner_t id);
|
||||||
int (*release) (struct inode *, struct file *);
|
int (*release) (struct inode *, struct file *);
|
||||||
|
|
|
@ -7,6 +7,45 @@
|
||||||
#include <linux/atomic.h>
|
#include <linux/atomic.h>
|
||||||
#include <uapi/linux/mman.h>
|
#include <uapi/linux/mman.h>
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Arrange for legacy / undefined architecture specific flags to be
|
||||||
|
* ignored by default in LEGACY_MAP_MASK.
|
||||||
|
*/
|
||||||
|
#ifndef MAP_32BIT
|
||||||
|
#define MAP_32BIT 0
|
||||||
|
#endif
|
||||||
|
#ifndef MAP_HUGE_2MB
|
||||||
|
#define MAP_HUGE_2MB 0
|
||||||
|
#endif
|
||||||
|
#ifndef MAP_HUGE_1GB
|
||||||
|
#define MAP_HUGE_1GB 0
|
||||||
|
#endif
|
||||||
|
#ifndef MAP_UNINITIALIZED
|
||||||
|
#define MAP_UNINITIALIZED 0
|
||||||
|
#endif
|
||||||
|
|
||||||
|
/*
|
||||||
|
* The historical set of flags that all mmap implementations implicitly
|
||||||
|
* support when a ->mmap_validate() op is not provided in file_operations.
|
||||||
|
*/
|
||||||
|
#define LEGACY_MAP_MASK (MAP_SHARED \
|
||||||
|
| MAP_PRIVATE \
|
||||||
|
| MAP_FIXED \
|
||||||
|
| MAP_ANONYMOUS \
|
||||||
|
| MAP_DENYWRITE \
|
||||||
|
| MAP_EXECUTABLE \
|
||||||
|
| MAP_UNINITIALIZED \
|
||||||
|
| MAP_GROWSDOWN \
|
||||||
|
| MAP_LOCKED \
|
||||||
|
| MAP_NORESERVE \
|
||||||
|
| MAP_POPULATE \
|
||||||
|
| MAP_NONBLOCK \
|
||||||
|
| MAP_STACK \
|
||||||
|
| MAP_HUGETLB \
|
||||||
|
| MAP_32BIT \
|
||||||
|
| MAP_HUGE_2MB \
|
||||||
|
| MAP_HUGE_1GB)
|
||||||
|
|
||||||
extern int sysctl_overcommit_memory;
|
extern int sysctl_overcommit_memory;
|
||||||
extern int sysctl_overcommit_ratio;
|
extern int sysctl_overcommit_ratio;
|
||||||
extern unsigned long sysctl_overcommit_kbytes;
|
extern unsigned long sysctl_overcommit_kbytes;
|
||||||
|
|
|
@ -16,6 +16,7 @@
|
||||||
|
|
||||||
#define MAP_SHARED 0x01 /* Share changes */
|
#define MAP_SHARED 0x01 /* Share changes */
|
||||||
#define MAP_PRIVATE 0x02 /* Changes are private */
|
#define MAP_PRIVATE 0x02 /* Changes are private */
|
||||||
|
#define MAP_SHARED_VALIDATE 0x03 /* share + validate extension flags */
|
||||||
#define MAP_TYPE 0x0f /* Mask for type of mapping */
|
#define MAP_TYPE 0x0f /* Mask for type of mapping */
|
||||||
#define MAP_FIXED 0x10 /* Interpret addr exactly */
|
#define MAP_FIXED 0x10 /* Interpret addr exactly */
|
||||||
#define MAP_ANONYMOUS 0x20 /* don't use a file */
|
#define MAP_ANONYMOUS 0x20 /* don't use a file */
|
||||||
|
|
15
mm/mmap.c
15
mm/mmap.c
|
@ -1387,9 +1387,24 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
|
||||||
|
|
||||||
if (file) {
|
if (file) {
|
||||||
struct inode *inode = file_inode(file);
|
struct inode *inode = file_inode(file);
|
||||||
|
unsigned long flags_mask;
|
||||||
|
|
||||||
|
flags_mask = LEGACY_MAP_MASK | file->f_op->mmap_supported_flags;
|
||||||
|
|
||||||
switch (flags & MAP_TYPE) {
|
switch (flags & MAP_TYPE) {
|
||||||
case MAP_SHARED:
|
case MAP_SHARED:
|
||||||
|
/*
|
||||||
|
* Force use of MAP_SHARED_VALIDATE with non-legacy
|
||||||
|
* flags. E.g. MAP_SYNC is dangerous to use with
|
||||||
|
* MAP_SHARED as you don't know which consistency model
|
||||||
|
* you will get. We silently ignore unsupported flags
|
||||||
|
* with MAP_SHARED to preserve backward compatibility.
|
||||||
|
*/
|
||||||
|
flags &= LEGACY_MAP_MASK;
|
||||||
|
/* fall through */
|
||||||
|
case MAP_SHARED_VALIDATE:
|
||||||
|
if (flags & ~flags_mask)
|
||||||
|
return -EOPNOTSUPP;
|
||||||
if ((prot&PROT_WRITE) && !(file->f_mode&FMODE_WRITE))
|
if ((prot&PROT_WRITE) && !(file->f_mode&FMODE_WRITE))
|
||||||
return -EACCES;
|
return -EACCES;
|
||||||
|
|
||||||
|
|
|
@ -16,6 +16,7 @@
|
||||||
|
|
||||||
#define MAP_SHARED 0x01 /* Share changes */
|
#define MAP_SHARED 0x01 /* Share changes */
|
||||||
#define MAP_PRIVATE 0x02 /* Changes are private */
|
#define MAP_PRIVATE 0x02 /* Changes are private */
|
||||||
|
#define MAP_SHARED_VALIDATE 0x03 /* share + validate extension flags */
|
||||||
#define MAP_TYPE 0x0f /* Mask for type of mapping */
|
#define MAP_TYPE 0x0f /* Mask for type of mapping */
|
||||||
#define MAP_FIXED 0x10 /* Interpret addr exactly */
|
#define MAP_FIXED 0x10 /* Interpret addr exactly */
|
||||||
#define MAP_ANONYMOUS 0x20 /* don't use a file */
|
#define MAP_ANONYMOUS 0x20 /* don't use a file */
|
||||||
|
|
Loading…
Reference in a new issue