On Fri, Jan 8, 2021 at 10:31 AM Andy Lutomirski [off-list ref] wrote:

Can we just remove vmsplice() support?  We could make it do a normal
copy, thereby getting rid of a fair amount of nastiness and potential
attacks.  Even ignoring issues relating to the length of time that the
vmsplice reference is alive, we also have whatever problems could be
caused by a malicious or misguided user vmsplice()ing some memory and
then modifying it.

Well, that "misguided user" is kind of the point, originally. That's
what zero-copying is all about.

But we could certainly remove it in favor of copying, because
zero-copy has seldom really been a huge advantage in practice outside
of benchmarks.

That said, I continue to not buy into Andrea's argument that
page_count() is wrong.

Instead, the argument is:

 (1) COW can never happen "too much": the definition of a private
mapping is that you have your own copy of the data.

 (2) the one counter case I feel is valid is page pinning when used
for a special "pseudo-shared memory" thing and that's basically what
FOLL_GUP does.

So _regardless_ of any vmsplice issues, I actually think that those
two basic rules should be our guiding principle.

And the corollary to (2) is that COW must absolutely NEVER re-use too
little. And that _was_ the bug with vmsplice, in that it allowed
re-use that it shouldn't have.

           Linus