vmmon: avoid kernel writes to eventfd

Starting with mainline commit 4d03e3cc5982 ("fs: don't allow kernel reads
and writes without iter ops") in 5.10-rc1, kernel writes are only allowed
for files providing ->write_iter() callback which eventfd does not.

As an attempt to address this issue on kernel side by providing
->write_iter() callback to eventfd was met with a pushback and it's not
clear if there is a chance for it to be accepted, let's use a specific
eventfd interface eventfd_signal() instead. However, as the comments in
HostIF_SemaphoreSignal() indicate that the file descriptor may also be
a pipe (without telling when), let's keep kernel_write() as a fallback
in case the file descriptor is not eventfd.

Signed-off-by: Michal Kubecek <mkubecek@suse.cz>

vmmon-only/common/crosspage.c

@@ -51,7 +51,9 @@
  * linux/frame.h dates back to 4.6-rc1, we need the STACK_FRAME_NON_STANDARD
  * definition from it which is there from the start.
  */
-#   if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 6, 0)
+#   if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)
+#      include <linux/objtool.h>
+#   elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 6, 0)
 #      include <linux/frame.h>
 #   endif
 #endif

vmmon-only/linux/hostif.c

@@ -55,6 +55,7 @@
 #include <linux/hrtimer.h>
 #include <linux/signal.h>
 #include <linux/taskstats_kern.h> // For linux/sched/signal.h without version check
+#include <linux/eventfd.h>
 
 #include "vmware.h"
 #include "x86apic.h"
@@ -2330,6 +2331,27 @@ HostIF_VMLockIsHeld(VMDriver *vm) // IN
 
 #if defined(CONFIG_SMP) || defined(CONFIG_X86_UP_IOAPIC) || \
     defined(CONFIG_X86_UP_APIC) || defined(CONFIG_X86_LOCAL_APIC)
+
+#if COMPAT_LINUX_VERSION_CHECK_LT(5, 8, 0)
+static long compat_copy_from_kernel_nofault(void *dst, VA src, size_t size)
+{
+   mm_segment_t old_fs;
+   long ret;
+
+   old_fs = get_fs();
+   set_fs(KERNEL_DS);
+   ret = HostIF_CopyFromUser(dst, src, size);
+   set_fs(old_fs);
+
+   return ret;
+}
+#else
+static long compat_copy_from_kernel_nofault(void *dst, VA src, size_t size)
+{
+   return copy_from_kernel_nofault(dst, (const void *)src, size);
+}
+#endif
+
 /*
  *----------------------------------------------------------------------
  *
@@ -2349,15 +2371,11 @@ HostIF_VMLockIsHeld(VMDriver *vm) // IN
 static Bool
 isVAReadable(VA r)  // IN:
 {
-   mm_segment_t old_fs;
    uint32 dummy;
-   int ret;
+   long ret;
 
-   old_fs = get_fs();
-   set_fs(KERNEL_DS);
    r = APICR_TO_ADDR(r, APICR_VERSION);
-   ret = HostIF_CopyFromUser(&dummy, r, sizeof dummy);
-   set_fs(old_fs);
+   ret = compat_copy_from_kernel_nofault(&dummy, r, sizeof(dummy));
 
    return ret == 0;
 }
@@ -2670,6 +2688,7 @@ HostIF_SemaphoreForceWakeup(VMDriver *vm,       // IN:
 int
 HostIF_SemaphoreSignal(uint64 *args)  // IN:
 {
+   struct eventfd_ctx *eventfd;
    struct file *file;
    int res;
    int signalFD = args[1];
@@ -2680,6 +2699,17 @@ HostIF_SemaphoreSignal(uint64 *args)  // IN:
       return MX_WAITERROR;
    }
 
+   /*
+    * If it's eventfd, use specific eventfd interface as kernel writes
+    * to eventfd may not be allowed in kernel 5.10 and later.
+    */
+   eventfd = eventfd_ctx_fileget(file);
+   if (!IS_ERR(eventfd)) {
+      eventfd_signal(eventfd, 1);
+      fput(file);
+      return MX_WAITNORMAL;
+   }
+
    /*
     * Always write sizeof(uint64) bytes. This works fine for eventfd and
     * pipes. The data written is formatted to make an eventfd happy should
@@ -3243,12 +3273,9 @@ static int
 HostIFFastClockThread(void *unused)  // IN:
 {
    int res;
-   mm_segment_t oldFS;
    unsigned int rate = 0;
    unsigned int prevRate = 0;
 
-   oldFS = get_fs();
-   set_fs(KERNEL_DS);
    allow_signal(SIGKILL);
 
    while ((rate = linuxState.fastClockRate) > MIN_RATE) {
@@ -3271,8 +3298,6 @@ HostIFFastClockThread(void *unused)  // IN:
    }
 
  out:
-   set_fs(oldFS);
-
    /*
     * Do not exit thread until we are told to do so.
     */

vmnet-only/userif.c

@@ -87,6 +87,24 @@ extern unsigned int  vnet_max_qlen;
 #   define skb_frag_off(frag) (frag)->page_offset
 #endif
 
+#if COMPAT_LINUX_VERSION_CHECK_LT(5, 10, 0)
+static inline
+__wsum compat_csum_and_copy_to_user(const void *src, void __user *dst, int len)
+{
+	int err;
+	__wsum ret;
+
+	ret = csum_and_copy_to_user(src, dst, len, 0, &err);
+	return err ? 0 : ret;
+}
+#else
+static inline
+__wsum compat_csum_and_copy_to_user(const void *src, void __user *dst, int len)
+{
+	return csum_and_copy_to_user(src, dst, len);
+}
+#endif
+
 /*
  *-----------------------------------------------------------------------------
  *
@@ -548,7 +566,6 @@ VNetCsumCopyDatagram(const struct sk_buff *skb,	// IN: skb to copy
 		     char *buf)			// OUT: where to copy data
 {
    unsigned int csum;
-   int err = 0;
    int len = skb_headlen(skb) - offset;
    char *curr = buf;
    const skb_frag_t *frag;
@@ -561,10 +578,9 @@ VNetCsumCopyDatagram(const struct sk_buff *skb,	// IN: skb to copy
       return -EINVAL;
    }
 
-   csum = csum_and_copy_to_user(skb->data + offset, curr, len, 0, &err);
-   if (err) {
-      return err;
-   }
+   csum = compat_csum_and_copy_to_user(skb->data + offset, curr, len);
+   if (!csum)
+	   return -EFAULT;
    curr += len;
 
    for (frag = skb_shinfo(skb)->frags;
@@ -575,13 +591,12 @@ VNetCsumCopyDatagram(const struct sk_buff *skb,	// IN: skb to copy
 	 const void *vaddr;
 
 	 vaddr = kmap(skb_frag_page(frag));
-	 tmpCsum = csum_and_copy_to_user(vaddr + skb_frag_off(frag),
-					 curr, skb_frag_size(frag), 0, &err);
+	 tmpCsum = compat_csum_and_copy_to_user(vaddr + skb_frag_off(frag),
+						curr, skb_frag_size(frag));
 	 kunmap(skb_frag_page(frag));
 
-	 if (err) {
-	    return err;
-	 }
+	 if (!tmpCsum)
+		 return -EFAULT;
 	 csum = csum_block_add(csum, tmpCsum, curr - buf);
 	 curr += skb_frag_size(frag);
       }