From 51190631968f2a69acf5da3e3412b003805538f2 Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Sat, 10 Jan 2026 20:46:25 +0100 Subject: [PATCH] tree-wide: lock in all memory pages when mlockall() is utilized, and on demand When employing MCL_FUTURE we don't actually want it to impose immediate population of malloc()-ed pages. Hence let's set MCL_ONFAULT everywhere. Additionally, specify MCL_CURRENT to ensure future memory allocations on already mapped pages are covered too. (Addresses https://github.com/systemd/systemd/pull/40319#discussion_r2693726196) Note that in shutdown the mlockall() is done to avoid keeping swap space busy, hence a dedicated call w/ MCL_CURRENT and w/o MCL_ONFAULT is made. --- src/cryptenroll/cryptenroll.c | 2 +- src/cryptsetup/cryptsetup.c | 2 +- src/shutdown/shutdown.c | 3 ++- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/cryptenroll/cryptenroll.c b/src/cryptenroll/cryptenroll.c index b2c291a2bd..ed66b6258f 100644 --- a/src/cryptenroll/cryptenroll.c +++ b/src/cryptenroll/cryptenroll.c @@ -850,7 +850,7 @@ static int run(int argc, char *argv[]) { return r; /* A delicious drop of snake oil */ - (void) mlockall(MCL_FUTURE); + (void) mlockall(MCL_CURRENT|MCL_FUTURE|MCL_ONFAULT); cryptsetup_enable_logging(NULL); diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c index e61f4b4606..d18e9fe7d2 100644 --- a/src/cryptsetup/cryptsetup.c +++ b/src/cryptsetup/cryptsetup.c @@ -2582,7 +2582,7 @@ static int verb_attach(int argc, char *argv[], void *userdata) { volume, source, strempty(arg_type), strempty(arg_cipher)); /* A delicious drop of snake oil */ - (void) mlockall(MCL_FUTURE); + (void) mlockall(MCL_CURRENT|MCL_FUTURE|MCL_ONFAULT); if (key_file && arg_keyfile_erase) destroy_key_file = key_file; /* let's get this baby erased when we leave */ diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c index 75872f2eda..e282aa9116 100644 --- a/src/shutdown/shutdown.c +++ b/src/shutdown/shutdown.c @@ -402,7 +402,8 @@ int main(int argc, char *argv[]) { init_watchdog(); /* Lock us into memory */ - (void) mlockall(MCL_CURRENT|MCL_FUTURE); + (void) mlockall(MCL_FUTURE|MCL_ONFAULT); + (void) mlockall(MCL_CURRENT); /* We need to make mounts private so that we can MS_MOVE in unmount_all(). Kernel does not allow * MS_MOVE when parent mountpoints have shared propagation. */