cursor: Use memfd_create() when available

Submitted by Emmanuel Gil Peyrot on Feb. 16, 2019, 3:35 p.m.

Details

Message ID 20190216153533.22531-1-linkmauve@linkmauve.fr
State Superseded
Headers show
Series "cursor: Use memfd_create() when available" ( rev: 1 ) in Wayland

Not browsing as part of any series.

Commit Message

Emmanuel Gil Peyrot Feb. 16, 2019, 3:35 p.m.
This (so-far) Linux-only API lets users create file descriptors purely
in memory, without any backing file on the filesystem and the race
condition which could ensue when unlink()ing it.

It also allows seals to be placed on the file, ensuring to every other
process that we won’t be allowed to shrink the contents, potentially
causing a SIGBUS when they try reading it.

This patch is best viewed with the -w option of git log -p.

Signed-off-by: Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
---
 configure.ac              |  2 +-
 cursor/os-compatibility.c | 56 ++++++++++++++++++++++++++++-----------
 2 files changed, 42 insertions(+), 16 deletions(-)

Patch hide | download patch | download mbox

diff --git a/configure.ac b/configure.ac
index 18fb649..27c4fb8 100644
--- a/configure.ac
+++ b/configure.ac
@@ -63,7 +63,7 @@  fi
 AC_SUBST(GCC_CFLAGS)
 
 AC_CHECK_HEADERS([sys/prctl.h])
-AC_CHECK_FUNCS([accept4 mkostemp posix_fallocate prctl])
+AC_CHECK_FUNCS([accept4 mkostemp posix_fallocate prctl memfd_create])
 
 AC_ARG_ENABLE([libraries],
 	      [AC_HELP_STRING([--disable-libraries],
diff --git a/cursor/os-compatibility.c b/cursor/os-compatibility.c
index e972d21..37ed198 100644
--- a/cursor/os-compatibility.c
+++ b/cursor/os-compatibility.c
@@ -25,6 +25,8 @@ 
 
 #define _GNU_SOURCE
 
+#include "config.h"
+
 #include <sys/types.h>
 #include <unistd.h>
 #include <fcntl.h>
@@ -32,7 +34,10 @@ 
 #include <string.h>
 #include <stdlib.h>
 
-#include "config.h"
+#ifdef HAVE_MEMFD_CREATE
+#include <sys/mman.h>
+#endif
+
 #include "os-compatibility.h"
 
 #ifndef HAVE_MKOSTEMP
@@ -99,6 +104,13 @@  create_tmpfile_cloexec(char *tmpname)
  * given size. If disk space is insufficent, errno is set to ENOSPC.
  * If posix_fallocate() is not supported, program may receive
  * SIGBUS on accessing mmap()'ed file contents instead.
+ *
+ * If the C library implements memfd_create(), it is used to create the
+ * file purely in memory, without any backing file name on the file
+ * system, and then sealing off the possibility of shrinking it.  This
+ * can then be checked before accessing mmap()'ed file contents, to
+ * make sure SIGBUS can't happen.  It also avoids requiring
+ * XDG_RUNTIME_DIR.
  */
 int
 os_create_anonymous_file(off_t size)
@@ -109,25 +121,39 @@  os_create_anonymous_file(off_t size)
 	int fd;
 	int ret;
 
-	path = getenv("XDG_RUNTIME_DIR");
-	if (!path) {
-		errno = ENOENT;
-		return -1;
-	}
+#ifdef HAVE_MEMFD_CREATE
+	fd = memfd_create("wayland-cursor", MFD_CLOEXEC | MFD_ALLOW_SEALING);
+	if (fd >= 0) {
+		/* We can add this seal before calling posix_fallocate(), as
+		 * the file is currently zero-sized anyway.
+		 *
+		 * There is also no need to check for the return value, we
+		 * couldn't doanything with it anyway.
+		 */
+		fcntl(fd, F_ADD_SEALS, F_SEAL_SHRINK | F_SEAL_SEAL);
+	} else
+#endif
+	{
+		path = getenv("XDG_RUNTIME_DIR");
+		if (!path) {
+			errno = ENOENT;
+			return -1;
+		}
 
-	name = malloc(strlen(path) + sizeof(template));
-	if (!name)
-		return -1;
+		name = malloc(strlen(path) + sizeof(template));
+		if (!name)
+			return -1;
 
-	strcpy(name, path);
-	strcat(name, template);
+		strcpy(name, path);
+		strcat(name, template);
 
-	fd = create_tmpfile_cloexec(name);
+		fd = create_tmpfile_cloexec(name);
 
-	free(name);
+		free(name);
 
-	if (fd < 0)
-		return -1;
+		if (fd < 0)
+			return -1;
+	}
 
 #ifdef HAVE_POSIX_FALLOCATE
 	ret = posix_fallocate(fd, 0, size);

Comments

On Saturday, February 16, 2019 4:35 PM, Emmanuel Gil Peyrot <linkmauve@linkmauve.fr> wrote:
> This (so-far) Linux-only API lets users create file descriptors purely
> in memory, without any backing file on the filesystem and the race
> condition which could ensue when unlink()ing it.
>
> It also allows seals to be placed on the file, ensuring to every other
> process that we won’t be allowed to shrink the contents, potentially
> causing a SIGBUS when they try reading it.
>
> This patch is best viewed with the -w option of git log -p.
>
> Signed-off-by: Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>

Nice! There's a small typo, but otherwise this LGTM.

Reviewed-by: Simon Ser <contact@emersion.fr>

> +#ifdef HAVE_MEMFD_CREATE
> +	fd = memfd_create("wayland-cursor", MFD_CLOEXEC | MFD_ALLOW_SEALING);
> +	if (fd >= 0) {
> +		/* We can add this seal before calling posix_fallocate(), as
> +		 * the file is currently zero-sized anyway.
> +		 *
> +		 * There is also no need to check for the return value, we
> +		 * couldn't doanything with it anyway.

Typo: "do anything"