Re: [PATCH 09/20] signal/vm86_32: Replace open coded BUG_ON with an actual BUG_ON

[Eric W. Biederman]

Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> writes:

> On Fri, Nov 12, 2021 at 11:57 AM Eric W. Biederman
> <ebiederm@xxxxxxxxxxxx> wrote:
>>
>> Still user space would have had to have mapped address 0 to get that
>> value set in do_sys_vm86.
>
> You have to map address 0 anyway just to get vm86 mode to work.
>
> vm86 mode fundamentally requires the low 1MB of virtual memory to be
> mapped, since there is no virtual memory offset in the vm86 model.

True.

However that also means if struct vm86plus_struct is at address 0
instead of the 16bit interrupt table something is badly wrong.

Still if we are going to check for userspace being silly that it should
be in do_sys_vm86.

I have managed to get the fuzzer that hit the problem to run and with
the test for !vm86->user_vm86 removed the BUG_ON is not being hit.

I am going to keep running it for a bit just to make certain, and
then I will put together a proper patch.

Eric