Revert "mm: introduce VM_POPULATE flag to better deal with racy userspace programs"

This reverts commit 186930500985 ("mm: introduce VM_POPULATE flag to
better deal with racy userspace programs").

VM_POPULATE only has any effect when userspace plays racy games with
vmas by trying to unmap and remap memory regions that mmap or mlock are
operating on.

Also, the only effect of VM_POPULATE when userspace plays such games is
that it avoids populating new memory regions that get remapped into the
address range that was being operated on by the original mmap or mlock
calls.

Let's remove VM_POPULATE as there isn't any strong argument to mandate a
new vm_flag.

Signed-off-by: Michel Lespinasse <walken@google.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Michel Lespinasse and committed by

Linus Torvalds 13 years ago 09a9f1d2 0776ce03

+11 -21

5 changed files

expand all

include

linux

mm.h

mman.h

fremap.c

mlock.c

mmap.c

-1

include/linux/mm.h

··· 87 87 #define VM_PFNMAP 0x00000400 /* Page-ranges managed without "struct page", just pure PFN */ 88 88 #define VM_DENYWRITE 0x00000800 /* ETXTBSY on write attempts.. */ 89 89 90 - #define VM_POPULATE 0x00001000 91 90 #define VM_LOCKED 0x00002000 92 91 #define VM_IO 0x00004000 /* Memory mapped I/O or similar */ 93 92

+1 -3

include/linux/mman.h

··· 79 79 { 80 80 return _calc_vm_trans(flags, MAP_GROWSDOWN, VM_GROWSDOWN ) | 81 81 _calc_vm_trans(flags, MAP_DENYWRITE, VM_DENYWRITE ) | 82 - ((flags & MAP_LOCKED) ? (VM_LOCKED | VM_POPULATE) : 0) | 83 - (((flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE) ? 84 - VM_POPULATE : 0); 82 + _calc_vm_trans(flags, MAP_LOCKED, VM_LOCKED ); 85 83 } 86 84 #endif /* _LINUX_MMAN_H */

+2 -10

mm/fremap.c

··· 204 204 unsigned long addr; 205 205 struct file *file = get_file(vma->vm_file); 206 206 207 - vm_flags = vma->vm_flags; 208 - if (!(flags & MAP_NONBLOCK)) 209 - vm_flags |= VM_POPULATE; 210 - addr = mmap_region(file, start, size, vm_flags, pgoff); 207 + addr = mmap_region(file, start, size, 208 + vma->vm_flags, pgoff); 211 209 fput(file); 212 210 if (IS_ERR_VALUE(addr)) { 213 211 err = addr; ··· 222 224 vma_nonlinear_insert(vma, &mapping->i_mmap_nonlinear); 223 225 flush_dcache_mmap_unlock(mapping); 224 226 mutex_unlock(&mapping->i_mmap_mutex); 225 - } 226 - 227 - if (!(flags & MAP_NONBLOCK) && !(vma->vm_flags & VM_POPULATE)) { 228 - if (!has_write_lock) 229 - goto get_write_lock; 230 - vma->vm_flags |= VM_POPULATE; 231 227 } 232 228 233 229 if (vma->vm_flags & VM_LOCKED) {

+5 -6

mm/mlock.c

··· 358 358 359 359 newflags = vma->vm_flags & ~VM_LOCKED; 360 360 if (on) 361 - newflags |= VM_LOCKED | VM_POPULATE; 361 + newflags |= VM_LOCKED; 362 362 363 363 tmp = vma->vm_end; 364 364 if (tmp > end) ··· 418 418 * range with the first VMA. Also, skip undesirable VMA types. 419 419 */ 420 420 nend = min(end, vma->vm_end); 421 - if ((vma->vm_flags & (VM_IO | VM_PFNMAP | VM_POPULATE)) != 422 - VM_POPULATE) 421 + if (vma->vm_flags & (VM_IO | VM_PFNMAP)) 423 422 continue; 424 423 if (nstart < vma->vm_start) 425 424 nstart = vma->vm_start; ··· 491 492 struct vm_area_struct * vma, * prev = NULL; 492 493 493 494 if (flags & MCL_FUTURE) 494 - current->mm->def_flags |= VM_LOCKED | VM_POPULATE; 495 + current->mm->def_flags |= VM_LOCKED; 495 496 else 496 - current->mm->def_flags &= ~(VM_LOCKED | VM_POPULATE); 497 + current->mm->def_flags &= ~VM_LOCKED; 497 498 if (flags == MCL_FUTURE) 498 499 goto out; 499 500 ··· 502 503 503 504 newflags = vma->vm_flags & ~VM_LOCKED; 504 505 if (flags & MCL_CURRENT) 505 - newflags |= VM_LOCKED | VM_POPULATE; 506 + newflags |= VM_LOCKED; 506 507 507 508 /* Ignore errors */ 508 509 mlock_fixup(vma, &prev, vma->vm_start, vma->vm_end, newflags);

+3 -1

mm/mmap.c

··· 1306 1306 } 1307 1307 1308 1308 addr = mmap_region(file, addr, len, vm_flags, pgoff); 1309 - if (!IS_ERR_VALUE(addr) && (vm_flags & VM_POPULATE)) 1309 + if (!IS_ERR_VALUE(addr) && 1310 + ((vm_flags & VM_LOCKED) || 1311 + (flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE)) 1310 1312 *populate = len; 1311 1313 return addr; 1312 1314 }

Configure Feed

Configure Feed