Fix NULL pointer dereference in eventfd read call

Starting with commit 12aceb89b0bc ("eventfd: convert to f_op->read_iter()")
in 5.8-rc1, the "read" function pointer in eventfd's file_operations is
NULL, "read_iter" is available instead.

Use kernel_read() and kernel_write() instead of directly calling the
function pointers to handle this correctly. We can do that safely for
kernel 4.14 and newer (older versions have different arguments of
kernel_read() and kernel_write()).

INSTALL

@@ -150,7 +150,7 @@ test build).
 When using a downloaded tarball, simply run
 
   tar -cf vmmon.tar vmmon-only
-  tar -cf vmnet.tar vmmon-only
+  tar -cf vmnet.tar vmnet-only
 
 to create the tarballs. In this case, there is no protection against
 unwanted local changes.

vmmon-only/include/hashFunc.h

@@ -251,6 +251,7 @@ static INLINE ub8 hash2(register const ub8 *k, /* the key */
   {
     /* c is reserved for the length */
   case  2: b+=k[1];
+	   /* fall through */
   case  1: a+=k[0];
     /* case 0: nothing left to add */
   }

vmmon-only/linux/hostif.c

@@ -47,7 +47,9 @@
 #include <asm/asm.h>
 #include <asm/io.h>
 #include <asm/page.h>
+#include <asm/tlbflush.h>
 #include <asm/uaccess.h>
+#include <asm/irq_vectors.h>
 #include <linux/capability.h>
 #include <linux/kthread.h>
 #include <linux/wait.h>
@@ -116,13 +118,7 @@
  */
 #define LOCKED_PAGE_SLACK 10000
 
-static struct {
-   Atomic_uint64     uptimeBase;
-   VersionedAtomic   version;
-   uint64            monotimeBase;
-   unsigned long     jiffiesBase;
-   struct timer_list timer;
-} uptimeState;
+u64 uptime_base;
 
 /*
  * First Page Locking strategy
@@ -190,17 +186,6 @@ static unsigned long compat_totalram_pages(void)
 #endif
 }
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
-static void do_gettimeofday(struct timeval *tv)
-{
-	struct timespec64 now;
-
-	ktime_get_real_ts64(&now);
-	tv->tv_sec = now.tv_sec;
-	tv->tv_usec = now.tv_nsec / 1000;
-}
-#endif
-
 #if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0) && defined(VERIFY_WRITE)
 	#define write_access_ok(addr, size) access_ok(VERIFY_WRITE, addr, size)
 #else
@@ -640,7 +625,24 @@ HostIF_FastClockUnlock(int callerID) // IN
 static void *
 MapCrossPage(struct page *p)  // IN:
 {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 8, 0)
    return vmap(&p, 1, VM_MAP, VM_PAGE_KERNEL_EXEC);
+#else
+   /* Starting with 5.8, vmap() always sets the NX bit, but the cross
+    * page needs to be executable. */
+   pte_t *ptes[1];
+   struct vm_struct *area = alloc_vm_area(1UL << PAGE_SHIFT, ptes);
+   if (area == NULL)
+      return NULL;
+
+   set_pte(ptes[0], mk_pte(p, VM_PAGE_KERNEL_EXEC));
+
+   preempt_disable();
+   __flush_tlb_all();
+   preempt_enable();
+
+   return area->addr;
+#endif
 }
 
 
@@ -1546,8 +1548,11 @@ HostIF_EstimateLockedPageLimit(const VMDriver* vm,                // IN
 #else
    lockedPages += global_page_state(NR_PAGETABLE);
 #endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 9, 0)
+   /* NR_SLAB_* converted to byte counters in 5.9 */
+   lockedPages += global_node_page_state_pages(NR_SLAB_UNRECLAIMABLE_B);
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
    /* NR_SLAB_* moved from zone to node in 4.13. */
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
    lockedPages += global_node_page_state(NR_SLAB_UNRECLAIMABLE);
 #else
    lockedPages += global_page_state(NR_SLAB_UNRECLAIMABLE);
@@ -1619,143 +1624,6 @@ HostIF_WaitForFreePages(unsigned int timeoutMs)  // IN:
 }
 
 
-/*
- *----------------------------------------------------------------------
- *
- * HostIFReadUptimeWork --
- *
- *      Reads the current uptime.  The uptime is based on getimeofday,
- *      which provides the needed high resolution.  However, we don't
- *      want uptime to be warped by e.g. calls to settimeofday.  So, we
- *      use a jiffies based monotonic clock to sanity check the uptime.
- *      If the uptime is more than one second from the monotonic time,
- *      we assume that the time of day has been set, and recalculate the
- *      uptime base to get uptime back on track with monotonic time.  On
- *      the other hand, we do expect jiffies based monotonic time and
- *      timeofday to have small drift (due to NTP rate correction, etc).
- *      We handle this by rebasing the jiffies based monotonic clock
- *      every second (see HostIFUptimeResyncMono).
- *
- * Results:
- *      The uptime, in units of UPTIME_FREQ.  Also returns the jiffies
- *      value that was used in the monotonic time calculation.
- *
- * Side effects:
- *      May reset the uptime base in the case gettimeofday warp was
- *      detected.
- *
- *----------------------------------------------------------------------
- */
-
-static uint64
-HostIFReadUptimeWork(unsigned long *j)  // OUT: current jiffies
-{
-   struct timeval tv;
-   uint64 monotime, uptime, upBase, monoBase;
-   int64 diff;
-   uint32 version;
-   unsigned long jifs, jifBase;
-   unsigned int attempts = 0;
-
- retry:
-   do {
-      version  = VersionedAtomic_BeginTryRead(&uptimeState.version);
-      jifs     = jiffies;
-      jifBase  = uptimeState.jiffiesBase;
-      monoBase = uptimeState.monotimeBase;
-   } while (!VersionedAtomic_EndTryRead(&uptimeState.version, version));
-
-   do_gettimeofday(&tv);
-   upBase = Atomic_Read64(&uptimeState.uptimeBase);
-
-   monotime = (uint64)(jifs - jifBase) * (UPTIME_FREQ / HZ);
-   monotime += monoBase;
-
-   uptime = tv.tv_usec * (UPTIME_FREQ / 1000000) + tv.tv_sec * UPTIME_FREQ;
-   uptime += upBase;
-
-   /*
-    * Use the jiffies based monotonic time to sanity check gettimeofday.
-    * If they differ by more than one second, assume the time of day has
-    * been warped, and use the jiffies time to undo (most of) the warp.
-    */
-
-   diff = uptime - monotime;
-   if (UNLIKELY(diff < -UPTIME_FREQ || diff > UPTIME_FREQ)) {
-      /* Compute a new uptimeBase to get uptime back on track. */
-      uint64 newUpBase = monotime - (uptime - upBase);
-
-      attempts++;
-      if (!Atomic_CMPXCHG64(&uptimeState.uptimeBase, upBase, newUpBase) &&
-          attempts < 5) {
-         /* Another thread updated uptimeBase.  Recalculate uptime. */
-         goto retry;
-      }
-      uptime = monotime;
-
-      Log("%s: detected settimeofday: fixed uptimeBase old %"FMT64"u "
-          "new %"FMT64"u attempts %u\n", __func__,
-          upBase, newUpBase, attempts);
-   }
-   *j = jifs;
-
-   return uptime;
-}
-
-
-/*
- *----------------------------------------------------------------------
- *
- * HostIFUptimeResyncMono --
- *
- *      Timer that fires ever second to resynchronize the jiffies based
- *      monotonic time with the uptime.
- *
- * Results:
- *      None
- *
- * Side effects:
- *      Resets the monotonic time bases so that jiffies based monotonic
- *      time does not drift from gettimeofday over the long term.
- *
- *----------------------------------------------------------------------
- */
-
-static void
-HostIFUptimeResyncMono(struct timer_list *timer)  // IN: ignored
-{
-   unsigned long jifs;
-   uintptr_t flags;
-
-   /*
-    * Read the uptime and the corresponding jiffies value.  This will
-    * also correct the uptime (which is based on time of day) if needed
-    * before we rebase monotonic time (which is based on jiffies).
-    */
-
-   uint64 uptime = HostIFReadUptimeWork(&jifs);
-
-   /*
-    * Every second, recalculate monoBase and jiffiesBase to squash small
-    * drift between gettimeofday and jiffies.  Also, this prevents
-    * (jiffies - jiffiesBase) wrap on 32-bits.
-    */
-
-   SAVE_FLAGS(flags);
-   CLEAR_INTERRUPTS();
-   VersionedAtomic_BeginWrite(&uptimeState.version);
-
-   uptimeState.monotimeBase = uptime;
-   uptimeState.jiffiesBase  = jifs;
-
-   VersionedAtomic_EndWrite(&uptimeState.version);
-   RESTORE_FLAGS(flags);
-
-   /* Reschedule this timer to expire in one second. */
-   mod_timer(&uptimeState.timer, jifs + HZ);
-}
-
-
 /*
  *----------------------------------------------------------------------
  *
@@ -1767,8 +1635,7 @@ HostIFUptimeResyncMono(struct timer_list *timer)  // IN: ignored
  *      None
  *
  * Side effects:
- *      Sets the initial values for the uptime state, and schedules
- *      the uptime timer.
+ *      Sets the initial value for the uptime base.
  *
  *----------------------------------------------------------------------
  */
@@ -1776,22 +1643,7 @@ HostIFUptimeResyncMono(struct timer_list *timer)  // IN: ignored
 void
 HostIF_InitUptime(void)
 {
-   struct timeval tv;
-
-   uptimeState.jiffiesBase = jiffies;
-   do_gettimeofday(&tv);
-   Atomic_Write64(&uptimeState.uptimeBase,
-                  -(tv.tv_usec * (UPTIME_FREQ / 1000000) +
-                    tv.tv_sec * UPTIME_FREQ));
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0) && !defined(timer_setup)
-   init_timer(&uptimeState.timer);
-   uptimeState.timer.function = (void *)HostIFUptimeResyncMono;
-   uptimeState.timer.data = (unsigned long)&uptimeState.timer;
-#else
-   timer_setup(&uptimeState.timer, HostIFUptimeResyncMono, 0);
-#endif
-   mod_timer(&uptimeState.timer, jiffies + HZ);
+   uptime_base = ktime_get_ns();
 }
 
 
@@ -1800,13 +1652,13 @@ HostIF_InitUptime(void)
  *
  * HostIF_CleanupUptime --
  *
- *      Cleanup uptime state, called at module unloading time.
+ *      No-op, left for backward compatibility.
  *
  * Results:
  *      None
  *
  * Side effects:
- *      Deschedule the uptime timer.
+ *      None
  *
  *----------------------------------------------------------------------
  */
@@ -1814,7 +1666,6 @@ HostIF_InitUptime(void)
 void
 HostIF_CleanupUptime(void)
 {
-   del_timer_sync(&uptimeState.timer);
 }
 
 
@@ -1838,9 +1689,10 @@ HostIF_CleanupUptime(void)
 uint64
 HostIF_ReadUptime(void)
 {
-   unsigned long jifs;
+   u64 tm;
 
-   return HostIFReadUptimeWork(&jifs);
+   tm = ktime_get_ns();
+   return (tm - uptime_base) / (NSEC_PER_SEC / UPTIME_FREQ);
 }
 
 
@@ -2217,7 +2069,7 @@ SetVMAPICAddr(VMDriver *vm, // IN/OUT: driver state
    volatile void *hostapic;
 
    ASSERT_ON_COMPILE(APICR_SIZE <= PAGE_SIZE);
-   hostapic = (volatile void *) ioremap_nocache(ma, PAGE_SIZE);
+   hostapic = (volatile void *) ioremap(ma, PAGE_SIZE);
    if (hostapic) {
       if ((APIC_VERSIONREG(hostapic) & 0xF0) == 0x10) {
          vm->hostAPIC.base = (volatile uint32 (*)[4]) hostapic;
@@ -2409,7 +2261,11 @@ HostIF_SemaphoreWait(VMDriver *vm,   // IN:
     * reading no bytes (EAGAIN - non blocking fd) or sizeof(uint64).
     */
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0)
+   res = kernel_read(file, (char *) &value, sizeof value, &file->f_pos);
+#else
    res = file->f_op->read(file, (char *) &value, sizeof value, &file->f_pos);
+#endif
 
    if (res == sizeof value) {
       res = MX_WAITNORMAL;
@@ -2522,7 +2378,11 @@ HostIF_SemaphoreSignal(uint64 *args)  // IN:
     * it be present.
     */
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0)
+   res = kernel_write(file, (char *) &value, sizeof value, &file->f_pos);
+#else
    res = file->f_op->write(file, (char *) &value, sizeof value, &file->f_pos);
+#endif
 
    if (res == sizeof value) {
       res = MX_WAITNORMAL;
@@ -3174,7 +3034,7 @@ HostIF_SetFastClockRate(unsigned int rate) // IN: Frequency in Hz.
       }
    } else {
       if (linuxState.fastClockThread) {
-         force_sig(SIGKILL, linuxState.fastClockThread);
+         send_sig(SIGKILL, linuxState.fastClockThread, 1);
          kthread_stop(linuxState.fastClockThread);
 
          linuxState.fastClockThread = NULL;

vmnet-only/bridge.c

@@ -66,7 +66,7 @@
 #endif
 
 #if LOGLEVEL >= 4
-static struct timeval vnetTime;
+static u64 vnetTime;
 #endif
 
 typedef struct VNetBridge VNetBridge;
@@ -693,7 +693,7 @@ VNetBridgeReceiveFromVNet(VNetJack        *this, // IN: jack
 
 	 netif_rx_ni(clone);
 #	 if LOGLEVEL >= 4
-	 do_gettimeofday(&vnetTime);
+	 vnetTime = ktime_get_ns();
 #	 endif
       }
    }
@@ -1490,12 +1490,11 @@ VNetBridgeReceiveFromDev(struct sk_buff *skb,         // IN: packet to receive
 
 #  if LOGLEVEL >= 4
    {
-      struct timeval now;
-      do_gettimeofday(&now);
+      u64 now;
+
+      now = ktime_get_ns();
       LOG(3, (KERN_DEBUG "bridge-%s: time %d\n",
-	      bridge->name,
-	      (int)((now.tv_sec * 1000000 + now.tv_usec)
-                    - (vnetTime.tv_sec * 1000000 + vnetTime.tv_usec))));
+	      bridge->name, (int)((now - vnetTime) / NSEC_PER_USEC)));
    }
 #  endif
 

vmnet-only/procfs.c

@@ -161,6 +161,14 @@ VNetProcOpen(struct inode *inode,   // IN:
 }
 
 /* Our procfs callbacks.  We only need to specialize open. */
+#ifdef DEFINE_PROC_SHOW_ATTRIBUTE
+static const struct proc_ops fops = {
+   .proc_open    = VNetProcOpen,
+   .proc_read    = seq_read,
+   .proc_lseek   = seq_lseek,
+   .proc_release = single_release,
+};
+#else
 static struct file_operations fops = {
    .open    = VNetProcOpen,
    .read    = seq_read,
@@ -168,6 +176,7 @@ static struct file_operations fops = {
    .release = single_release,
 };
 #endif
+#endif
 
 
 /*

vmnet-only/userif.c

@@ -78,13 +78,33 @@ static int  VNetUserIfSetUplinkState(VNetPort *port, uint8 linkUp);
 extern unsigned int  vnet_max_qlen;
 
 #if COMPAT_LINUX_VERSION_CHECK_LT(3, 2, 0)
-#   define compat_kmap(page) kmap(page)
-#   define compat_kunmap(page) kunmap(page)
+#   define compat_kmap_frag(frag) kmap((frag)->page)
+#   define compat_kunmap_frag(page) kunmap((frag)->page)
 #else
-#   define compat_kmap(page) kmap((page).p)
-#   define compat_kunmap(page) kunmap((page).p)
+#   define compat_kmap_frag(frag) kmap(skb_frag_page(frag))
+#   define compat_kunmap_frag(frag) kunmap(skb_frag_page(frag))
 #endif
 
+static unsigned int compat_skb_frag_size(const skb_frag_t *frag)
+{
+#if COMPAT_LINUX_VERSION_CHECK_LT(3, 2, 0)
+	return frag->size;
+#else
+	return skb_frag_size(frag);
+#endif
+}
+
+static unsigned int compat_skb_frag_off(const skb_frag_t *frag)
+{
+#if COMPAT_LINUX_VERSION_CHECK_LT(5, 4, 0) && \
+	!(defined(CONFIG_SUSE_VERSION) && CONFIG_SUSE_VERSION == 15 && \
+	  defined(CONFIG_SUSE_PATCHLEVEL) && CONFIG_SUSE_PATCHLEVEL >= 2)
+	return frag->page_offset;
+#else
+	return skb_frag_off(frag);
+#endif
+}
+
 #if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0) && defined(VERIFY_WRITE)
 	#define write_access_ok(addr, size) access_ok(VERIFY_WRITE, addr, size)
 #else
@@ -565,20 +585,21 @@ VNetCsumCopyDatagram(const struct sk_buff *skb,	// IN: skb to copy
    for (frag = skb_shinfo(skb)->frags;
 	frag != skb_shinfo(skb)->frags + skb_shinfo(skb)->nr_frags;
 	frag++) {
-      if (frag->size > 0) {
+      if (compat_skb_frag_size(frag) > 0) {
 	 unsigned int tmpCsum;
 	 const void *vaddr;
 
-	 vaddr = compat_kmap(frag->page);
-	 tmpCsum = csum_and_copy_to_user(vaddr + frag->page_offset,
-					 curr, frag->size, 0, &err);
-	 compat_kunmap(frag->page);
+	 vaddr = compat_kmap_frag(frag);
+	 tmpCsum = csum_and_copy_to_user(vaddr + compat_skb_frag_off(frag),
+					 curr, compat_skb_frag_size(frag), 0,
+					 &err);
+	 compat_kunmap_frag(frag);
 
 	 if (err) {
 	    return err;
 	 }
 	 csum = csum_block_add(csum, tmpCsum, curr - buf);
-	 curr += frag->size;
+	 curr += compat_skb_frag_size(frag);
       }
    }