From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6DB3CC433DB for ; Fri, 8 Jan 2021 18:55:12 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id CCBA423A9A for ; Fri, 8 Jan 2021 18:55:11 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org CCBA423A9A Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 0A27E8D0199; Fri, 8 Jan 2021 13:55:11 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 02B938D0156; Fri, 8 Jan 2021 13:55:10 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E5C238D0199; Fri, 8 Jan 2021 13:55:10 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0053.hostedemail.com [216.40.44.53]) by kanga.kvack.org (Postfix) with ESMTP id CBCC28D0156 for ; Fri, 8 Jan 2021 13:55:10 -0500 (EST) Received: from smtpin17.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 728123647 for ; Fri, 8 Jan 2021 18:55:10 +0000 (UTC) X-FDA: 77683510380.17.burst04_4711818274f5 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin17.hostedemail.com (Postfix) with ESMTP id 514E5180D0185 for ; Fri, 8 Jan 2021 18:55:10 +0000 (UTC) X-HE-Tag: burst04_4711818274f5 X-Filterd-Recvd-Size: 5375 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf29.hostedemail.com (Postfix) with ESMTP for ; Fri, 8 Jan 2021 18:55:09 +0000 (UTC) Received: by mail.kernel.org (Postfix) with ESMTPSA id 7ED5D23A81; Fri, 8 Jan 2021 18:55:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1610132108; bh=N9EmXGrgmYlUphwBezd2dWcyGDB4qIvxjfleKtsSxOA=; h=From:To:Cc:Subject:Date:From; b=RvetMlQlpoTK18Fx/HC7kBIkYjxFXSXyVnOGUTHpiiHgA2fImH9os/+ZrTZaG70bb poXYctrgdZTeIqy/xHPZlWlD0fb3IA3IfWprH0sU5pHq3C81cCaghsRKGMtFHufPW/ N9UYEmxFD7Wch7dInqBGVOCN3Xs+oK/HnrwRmKT2wI1Y3cu6Z3cLKN2AFrXSEddhCJ hGP4QH6DHUba/lk2FGTligk2bg+cU3uidowkBXflazNpfc57OJwnx4+9VJUtRtlvjE 8DKeUZjkHqRMi/8mVkCO+EqDS7drpr3FjLWzpAXxqwwIlky+Dwcffduk1xgPNmud6u FyxjHnYCNcAKw== From: Andy Lutomirski To: x86@kernel.org Cc: LKML , Andy Lutomirski , Andrea Arcangeli , Linux-MM , Jason Gunthorpe , Linus Torvalds , Matthew Wilcox , Jann Horn , Jan Kara , Yu Zhao , Peter Xu Subject: [PATCH] x86/vm86/32: Remove VM86_SCREEN_BITMAP support Date: Fri, 8 Jan 2021 10:55:05 -0800 Message-Id: <3d34069ab2d249d866ea1d18a47e4170dbfb5982.1610132102.git.luto@kernel.org> X-Mailer: git-send-email 2.29.2 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The implementation was rather buggy. It unconditionally marked PTEs read-only, even for VM_SHARED mappings. I'm not sure whether this is actually a problem, but it certainly seems unwise. More importantly, it released the mmap lock before flushing the TLB, which could allow a racin= g CoW operation to falsely believe that the underlying memory was not writable. I can't find any users at all of this mechanism, so just remove it. Cc: Andrea Arcangeli Cc: Linux-MM Cc: Jason Gunthorpe Cc: x86@kernel.org Cc: Linus Torvalds Cc: Matthew Wilcox Cc: Jann Horn Cc: Jan Kara Cc: Yu Zhao Cc: Peter Xu Signed-off-by: Andy Lutomirski --- arch/x86/include/uapi/asm/vm86.h | 2 +- arch/x86/kernel/vm86_32.c | 55 ++++++-------------------------- 2 files changed, 10 insertions(+), 47 deletions(-) diff --git a/arch/x86/include/uapi/asm/vm86.h b/arch/x86/include/uapi/asm= /vm86.h index d2ee4e307ef8..50004fb4590d 100644 --- a/arch/x86/include/uapi/asm/vm86.h +++ b/arch/x86/include/uapi/asm/vm86.h @@ -106,7 +106,7 @@ struct vm86_struct { /* * flags masks */ -#define VM86_SCREEN_BITMAP 0x0001 +#define VM86_SCREEN_BITMAP 0x0001 /* no longer supported */ =20 struct vm86plus_info_struct { unsigned long force_return_for_pic:1; diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c index 764573de3996..28b9e8d511e1 100644 --- a/arch/x86/kernel/vm86_32.c +++ b/arch/x86/kernel/vm86_32.c @@ -160,49 +160,6 @@ void save_v86_state(struct kernel_vm86_regs *regs, i= nt retval) do_exit(SIGSEGV); } =20 -static void mark_screen_rdonly(struct mm_struct *mm) -{ - struct vm_area_struct *vma; - spinlock_t *ptl; - pgd_t *pgd; - p4d_t *p4d; - pud_t *pud; - pmd_t *pmd; - pte_t *pte; - int i; - - mmap_write_lock(mm); - pgd =3D pgd_offset(mm, 0xA0000); - if (pgd_none_or_clear_bad(pgd)) - goto out; - p4d =3D p4d_offset(pgd, 0xA0000); - if (p4d_none_or_clear_bad(p4d)) - goto out; - pud =3D pud_offset(p4d, 0xA0000); - if (pud_none_or_clear_bad(pud)) - goto out; - pmd =3D pmd_offset(pud, 0xA0000); - - if (pmd_trans_huge(*pmd)) { - vma =3D find_vma(mm, 0xA0000); - split_huge_pmd(vma, pmd, 0xA0000); - } - if (pmd_none_or_clear_bad(pmd)) - goto out; - pte =3D pte_offset_map_lock(mm, pmd, 0xA0000, &ptl); - for (i =3D 0; i < 32; i++) { - if (pte_present(*pte)) - set_pte(pte, pte_wrprotect(*pte)); - pte++; - } - pte_unmap_unlock(pte, ptl); -out: - mmap_write_unlock(mm); - flush_tlb_mm_range(mm, 0xA0000, 0xA0000 + 32*PAGE_SIZE, PAGE_SHIFT, fal= se); -} - - - static int do_vm86_irq_handling(int subfunction, int irqnumber); static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool p= lus); =20 @@ -282,6 +239,15 @@ static long do_sys_vm86(struct vm86plus_struct __use= r *user_vm86, bool plus) offsetof(struct vm86_struct, int_revectored))) return -EFAULT; =20 + + /* VM86_SCREEN_BITMAP had numerous bugs and appears to have no users. *= / + if (v.flags & VM86_SCREEN_BITMAP) { + char comm[TASK_COMM_LEN]; + + pr_info_once("vm86: '%s' uses VM86_SCREEN_BITMAP, which is no longer s= upported\n", get_task_comm(comm, current); + return -EINVAL; + } + memset(&vm86regs, 0, sizeof(vm86regs)); =20 vm86regs.pt.bx =3D v.regs.ebx; @@ -370,9 +336,6 @@ static long do_sys_vm86(struct vm86plus_struct __user= *user_vm86, bool plus) update_task_stack(tsk); preempt_enable(); =20 - if (vm86->flags & VM86_SCREEN_BITMAP) - mark_screen_rdonly(tsk->mm); - memcpy((struct kernel_vm86_regs *)regs, &vm86regs, sizeof(vm86regs)); return regs->ax; } --=20 2.29.2