vmmon: check presence of file_operations::poll()

Commit 11c5ad0ec441 ("eventpoll: switch to ->poll_mask") in v4.18-rc1, made
eventpoll switch from ->poll() to ->poll_mask(), resulting in a null
pointer dereference as vmmon calls the callback directly without checking
its availability.

Rather than calling the callback directly (which would result in null
pointer dereference), use vfs_poll() wrapper. As this wrapper is only
available since 4.18-rc1 cycle as well, provide a copy to use when building
against older kernels.

Note: even if the commit revealing the problem was reverted in 4.18-rc3
(and is unlikely to go back in the same form) so that vmmon no longer
crashes with 4.18 kernel, calling the callback without a check is a bad
practice so let's keep the patch in place.

vmmon-only/Makefile

@@ -107,7 +107,7 @@ prebuild:: ;
 postbuild:: ;
 
 $(DRIVER_KO): prebuild
-	$(MAKE) -C $(BUILD_DIR) M=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
+	$(MAKE) -C $(BUILD_DIR) SUBDIRS=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) modules
 	$(MAKE) -C $$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) postbuild

vmmon-only/linux/driver.c

@@ -73,9 +73,6 @@ static Bool LinuxDriverCheckPadding(void);
 
 struct VMXLinuxState linuxState;
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 17, 0)
-typedef int vm_fault_t;
-#endif
 
 /*
  *----------------------------------------------------------------------
@@ -100,9 +97,9 @@ long LinuxDriver_Ioctl(struct file *filp, u_int iocmd,
 
 static int LinuxDriver_Close(struct inode *inode, struct file *filp);
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
-static vm_fault_t LinuxDriverFault(struct vm_fault *fault);
+static int LinuxDriverFault(struct vm_fault *fault);
 #else
-static vm_fault_t LinuxDriverFault(struct vm_area_struct *vma, struct vm_fault *fault);
+static int LinuxDriverFault(struct vm_area_struct *vma, struct vm_fault *fault);
 #endif
 static int LinuxDriverMmap(struct file *filp, struct vm_area_struct *vma);
 
@@ -598,7 +595,7 @@ LinuxDriver_Close(struct inode *inode, // IN
  *-----------------------------------------------------------------------------
  */
 
-static vm_fault_t
+static int
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
 LinuxDriverFault(struct vm_fault *fault)     //IN/OUT
 #else

vmmon-only/linux/hostif.c

@@ -183,32 +183,6 @@ static void UnlockEntry(void *clientData, MemTrackEntry *entryPtr);
 uint8 monitorIPIVector;
 uint8 hvIPIVector;
 
-static unsigned long compat_totalram_pages(void)
-{
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
-	return totalram_pages;
-#else
-	return totalram_pages();
-#endif
-}
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
-static void do_gettimeofday(struct timeval *tv)
-{
-	struct timespec64 now;
-
-	ktime_get_real_ts64(&now);
-	tv->tv_sec = now.tv_sec;
-	tv->tv_usec = now.tv_nsec / 1000;
-}
-#endif
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0) && defined(VERIFY_WRITE)
-	#define write_access_ok(addr, size) access_ok(VERIFY_WRITE, addr, size)
-#else
-	#define write_access_ok(addr, size) access_ok(addr, size)
-#endif
-
 /*
  *-----------------------------------------------------------------------------
  *
@@ -1660,7 +1634,14 @@ unsigned int
 HostIF_EstimateLockedPageLimit(const VMDriver* vm,                // IN
                                unsigned int currentlyLockedPages) // IN
 {
-   unsigned int totalPhysicalPages = compat_totalram_pages();
+   /*
+    * This variable is available and exported to modules,
+    * since at least 2.6.0.
+    */
+
+   extern unsigned long totalram_pages;
+
+   unsigned int totalPhysicalPages = totalram_pages;
 
    /*
     * Use the memory information linux exports as of late for a more
@@ -2305,7 +2286,7 @@ isVAReadable(VA r)  // IN:
    int ret;
 
    old_fs = get_fs();
-   set_fs(KERNEL_DS);
+   set_fs(get_ds());
    r = APICR_TO_ADDR(r, APICR_VERSION);
    ret = HostIF_CopyFromUser(&dummy, r, sizeof dummy);
    set_fs(old_fs);
@@ -2582,7 +2563,7 @@ HostIF_SemaphoreWait(VMDriver *vm,   // IN:
    }
 
    old_fs = get_fs();
-   set_fs(KERNEL_DS);
+   set_fs(get_ds());
 
    {
       struct poll_wqueues table;
@@ -2711,7 +2692,7 @@ HostIF_SemaphoreSignal(uint64 *args)  // IN:
    }
 
    old_fs = get_fs();
-   set_fs(KERNEL_DS);
+   set_fs(get_ds());
 
    /*
     * Always write sizeof(uint64) bytes. This works fine for eventfd and
@@ -3425,7 +3406,7 @@ HostIF_MapUserMem(VA addr,                  // IN: User memory virtual address
 
    ASSERT(handle);
 
-   if (!write_access_ok(p, size)) {
+   if (!access_ok(VERIFY_WRITE, p, size)) {
       printk(KERN_ERR "%s: Couldn't verify write to uva 0x%p with size %"
              FMTSZ"u\n", __func__, p, size);
 

vmnet-only/Makefile

@@ -107,7 +107,7 @@ prebuild:: ;
 postbuild:: ;
 
 $(DRIVER_KO): prebuild
-	$(MAKE) -C $(BUILD_DIR) M=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
+	$(MAKE) -C $(BUILD_DIR) SUBDIRS=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) modules
 	$(MAKE) -C $$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) postbuild

vmnet-only/userif.c

@@ -85,12 +85,6 @@ extern unsigned int  vnet_max_qlen;
 #   define compat_kunmap(page) kunmap((page).p)
 #endif
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0) && defined(VERIFY_WRITE)
-	#define write_access_ok(addr, size) access_ok(VERIFY_WRITE, addr, size)
-#else
-	#define write_access_ok(addr, size) access_ok(addr, size)
-#endif
-
 /*
  *-----------------------------------------------------------------------------
  *
@@ -148,7 +142,7 @@ VNetUserIfMapPtr(VA uAddr,        // IN: pointer to user memory
                  struct page **p, // OUT: locked page
                  void **ptr)      // OUT: kernel mapped pointer
 {
-   if (!write_access_ok((void *)uAddr, size) ||
+   if (!access_ok(VERIFY_WRITE, (void *)uAddr, size) ||
        (((uAddr + size - 1) & ~(PAGE_SIZE - 1)) !=
         (uAddr & ~(PAGE_SIZE - 1)))) {
       return -EINVAL;