Re: [PATCH v7 01/14] mm: Add F_SEAL_AUTO_ALLOCATE seal to memfd

On Tue, Aug 23, 2022 at 09:36:57AM +0200, David Hildenbrand wrote:

On 18.08.22 01:41, Kirill A. Shutemov wrote:

quoted

On Fri, Aug 05, 2022 at 07:55:38PM +0200, Paolo Bonzini wrote:

quoted

On 7/21/22 11:44, David Hildenbrand wrote:

quoted

Also, I*think*  you can place pages via userfaultfd into shmem. Not
sure if that would count "auto alloc", but it would certainly bypass
fallocate().

Yeah, userfaultfd_register would probably have to forbid this for
F_SEAL_AUTO_ALLOCATE vmas.  Maybe the memfile_node can be reused for this,
adding a new MEMFILE_F_NO_AUTO_ALLOCATE flags?  Then userfault_register
would do something like memfile_node_get_flags(vma->vm_file) and check the
result.

I donno, memory allocation with userfaultfd looks pretty intentional to
me. Why would F_SEAL_AUTO_ALLOCATE prevent it?

Can't we say the same about a write()?

quoted

Maybe we would need it in the future for post-copy migration or something?

Or existing practises around userfaultfd touch memory randomly and
therefore incompatible with F_SEAL_AUTO_ALLOCATE intent?

Note, that userfaultfd is only relevant for shared memory as it requires
VMA which we don't have for MFD_INACCESSIBLE.

This feature (F_SEAL_AUTO_ALLOCATE) is independent of all the lovely
encrypted VM stuff, so it doesn't matter how it relates to MFD_INACCESSIBLE.

Right, this patch is for normal user accssible fd. In KVM this flag is
expected to be set on the shared part of the memslot, while all other
patches in this series are for private part of the memslot.

Private memory doesn't have this need because it's totally inaccissible
from userspace so no chance for userspace to write to the fd and cause
allocation by accident. While for shared memory, malicious/buggy guest
OS may cause userspace to write to any range of the shared fd and cause
memory allocation, even that range should the private memory not the
shared memory be visible to guest OS.

Chao

-- 
Thanks,

David / dhildenb