Re: [PATCH v10 1/9] mm: Introduce memfd_restricted system call to create restricted user memory

[Nikunj A. Dadhania]

> +static struct file *restrictedmem_file_create(struct file *memfd)
> +{
> +     struct restrictedmem_data *data;
> +     struct address_space *mapping;
> +     struct inode *inode;
> +     struct file *file;
> +
> +     data = kzalloc(sizeof(*data), GFP_KERNEL);
> +     if (!data)
> +             return ERR_PTR(-ENOMEM);
> +
> +     data->memfd = memfd;
> +     mutex_init(&data->lock);
> +     INIT_LIST_HEAD(&data->notifiers);
> +
> +     inode = alloc_anon_inode(restrictedmem_mnt->mnt_sb);
> +     if (IS_ERR(inode)) {
> +             kfree(data);
> +             return ERR_CAST(inode);
> +     }

alloc_anon_inode() uses new_pseudo_inode() to get the inode. As per the 
comment, new inode 
is not added to the superblock s_inodes list.

/**
 *      new_inode_pseudo        - obtain an inode
 *      @sb: superblock
 *
 *      Allocates a new inode for given superblock.
 *      Inode wont be chained in superblock s_inodes list
 *      This means :
 *      - fs can't be unmount
 *      - quotas, fsnotify, writeback can't work
 */

So the restrictedmem_error_page will not find the inode as it was never added 
to the s_inodes list.

We might need to add the inode after allocating.

        inode_sb_list_add(inode);

> +void restrictedmem_error_page(struct page *page, struct address_space 
> *mapping)
> +{
> +     struct super_block *sb = restrictedmem_mnt->mnt_sb;
> +     struct inode *inode, *next;
> +
> +     if (!shmem_mapping(mapping))
> +             return;
> +
> +     spin_lock(&sb->s_inode_list_lock);
> +     list_for_each_entry_safe(inode, next, &sb->s_inodes, i_sb_list) {
> +             struct restrictedmem_data *data = 
> inode->i_mapping->private_data;
> +             struct file *memfd = data->memfd;
> +
> +             if (memfd->f_mapping == mapping) {
> +                     pgoff_t start, end;
> +
> +                     spin_unlock(&sb->s_inode_list_lock);
> +
> +                     start = page->index;
> +                     end = start + thp_nr_pages(page);
> +                     restrictedmem_notifier_error(data, start, end);
> +                     return;
> +             }
> +     }
> +     spin_unlock(&sb->s_inode_list_lock);
> +}

Regards
Nikunj