Allow host mappings to have destructors #700

Activity

1. syntactically

   added

   area/performanceAddresses performanceAddresses performance

   lifecycle/confirmedBug is verified or proposal seems reasonableBug is verified or proposal seems reasonable

   on Jul 8, 2025
2. syntactically

   added the

   Bug

   issue type on Jul 8, 2025
3. danbugs

   added this to the v0.8.0 milestone on Jul 16, 2025
4. danbugs

   assigned

   jsturtevant

   on Jul 16, 2025
5. danbugs

   modified the milestones: v0.8.0, v0.9.0 on Jul 30, 2025
6. danbugs

   modified the milestones: v0.9.0, v0.10.0 on Aug 13, 2025
7. ludfjig commented on Aug 27, 2025

   

   ludfjig

   on Aug 27, 2025

   Contributor

   More actions

   Since map_file_cow currently only calls map_region, could we remove map_file_cow, and have the caller just use map_region and keep track of the handle themselves?
8. danbugs

   modified the milestones: v0.10.0, v0.11.0 on Oct 1, 2025
9. devigned

   assigned

   ludfjig

   and unassigned

   jsturtevant

   on Oct 22, 2025
10. devigned

    modified the milestones: v0.11.0, v0.12.0 on Oct 22, 2025
11. jsturtevant

    modified the milestones: v0.12.0, v0.13.0 on Nov 5, 2025
12. jsturtevant

    modified the milestones: v0.13.0, Backlog on Feb 18, 2026
13. simongdavies

    marked Linux map_file_cow leaks VMA entries (missing munmap on success path) #1290 as a duplicate of this issue on Mar 11, 2026
14. simongdavies

    modified the milestones: Backlog, v0.14.0 on Mar 11, 2026
15. jsturtevant commented on Mar 11, 2026

    

    jsturtevant

    on Mar 11, 2026

    Contributor

    More actions

    from #1290:

    Root Cause
    The raw *mut c_void pointer returned by libc::mmap is cast to usize and stored in MemoryRegion.host_region — a plain integer with no ownership or Drop semantics. Nothing in the cleanup chain calls munmap:
    
    HyperlightVm::unmap_region — removes the KVM/MSHV slot only, does not munmap
    HyperlightVm::Drop — only calls interrupt_handle.set_dropped()
    MultiUseSandbox — has no Drop impl
    Snapshot restore() — calls unmap_region for stale regions (same problem)
    The error path in map_file_cow correctly calls munmap, confirming the success path omission is an oversight.
    
    Proposed Fix
    Introduce a Linux OwnedFileMapping struct that stores the mmap pointer and size with a Drop impl calling libc::munmap. Track these in a Vec on MultiUseSandbox and clean up in restore() (when regions are unmapped during snapshot restore) and on MultiUseSandbox::Drop (catch-all for remaining mappings).
    
16. syntactically commented on Aug 5, 2026

    

    syntactically

    on Aug 5, 2026

    MemberAuthor

    More actions

    The correct solution here is probably that map_region instead of taking a MemoryRegion directly takes some where for<'a> &'a T: Into<MemoryRegion> + Clone object that it holds onto and drops at the appropriate times. When map_file_cow calls map_region, it uses some (arch-specific) FileMapping structure that implements that properly. That would also let you write code that shared one mapping between multiple sandboxes and use it on both Linux and Windows without disaster striking from the strange lifecycle management of the region on Windows.