vmmon: check presence of file_operations::poll()

Commit 11c5ad0ec441 ("eventpoll: switch to ->poll_mask") in v4.18-rc1, made eventpoll switch from ->poll() to ->poll_mask(), resulting in a null pointer dereference as vmmon calls the callback directly without checking its availability. Rather than calling the callback directly (which would result in null pointer dereference), use vfs_poll() wrapper. As this wrapper is only available since 4.18-rc1 cycle as well, provide a copy to use when building against older kernels. Note: even if the commit revealing the problem was reverted in 4.18-rc3 (and is unlikely to go back in the same form) so that vmmon no longer crashes with 4.18 kernel, calling the callback without a check is a bad practice so let's keep the patch in place.
vmmon: fix indirect call with retpoline build
2018-08-20 07:46:13 +02:00 · 2018-08-20 07:37:40 +02:00 · 2018-08-20 07:37:33 +02:00 · 2018-08-20 07:37:29 +02:00 · 2018-08-20 07:36:26 +02:00 · 2018-08-20 07:34:04 +02:00
5 changed files with 18 additions and 46 deletions
@@ -107,7 +107,7 @@ prebuild:: ;
 postbuild:: ;

 $(DRIVER_KO): prebuild
-	$(MAKE) -C $(BUILD_DIR) M=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
+	$(MAKE) -C $(BUILD_DIR) SUBDIRS=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) modules
 	$(MAKE) -C $$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) postbuild
@@ -73,9 +73,6 @@ static Bool LinuxDriverCheckPadding(void);

 struct VMXLinuxState linuxState;

-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 17, 0)
-typedef int vm_fault_t;
-#endif

 /*
 *----------------------------------------------------------------------
@@ -100,9 +97,9 @@ long LinuxDriver_Ioctl(struct file *filp, u_int iocmd,

 static int LinuxDriver_Close(struct inode *inode, struct file *filp);
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
-static vm_fault_t LinuxDriverFault(struct vm_fault *fault);
+static int LinuxDriverFault(struct vm_fault *fault);
 #else
-static vm_fault_t LinuxDriverFault(struct vm_area_struct *vma, struct vm_fault *fault);
+static int LinuxDriverFault(struct vm_area_struct *vma, struct vm_fault *fault);
 #endif
 static int LinuxDriverMmap(struct file *filp, struct vm_area_struct *vma);

@@ -597,7 +594,7 @@ LinuxDriver_Close(struct inode *inode, // IN
 *-----------------------------------------------------------------------------
 */

-static vm_fault_t
+static int
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
 LinuxDriverFault(struct vm_fault *fault)     //IN/OUT
 #else
@@ -181,32 +181,6 @@ static struct {
 uint8 monitorIPIVector;
 uint8 hvIPIVector;

-static unsigned long compat_totalram_pages(void)
-{
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
-	return totalram_pages;
-#else
-	return totalram_pages();
-#endif
-}
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
-static void do_gettimeofday(struct timeval *tv)
-{
-	struct timespec64 now;
-
-	ktime_get_real_ts64(&now);
-	tv->tv_sec = now.tv_sec;
-	tv->tv_usec = now.tv_nsec / 1000;
-}
-#endif
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0) && defined(VERIFY_WRITE)
-	#define write_access_ok(addr, size) access_ok(VERIFY_WRITE, addr, size)
-#else
-	#define write_access_ok(addr, size) access_ok(addr, size)
-#endif
-
 /*
 *-----------------------------------------------------------------------------
 *
@@ -1521,7 +1495,14 @@ unsigned int
 HostIF_EstimateLockedPageLimit(const VMDriver* vm,                // IN
                               unsigned int currentlyLockedPages) // IN
 {
-   unsigned int totalPhysicalPages = compat_totalram_pages();
+   /*
+    * This variable is available and exported to modules,
+    * since at least 2.6.0.
+    */
+
+   extern unsigned long totalram_pages;
+
+   unsigned int totalPhysicalPages = totalram_pages;

   /*
    * Use the memory information linux exports as of late for a more
@@ -2184,7 +2165,7 @@ isVAReadable(VA r)  // IN:
   int ret;

   old_fs = get_fs();
-   set_fs(KERNEL_DS);
+   set_fs(get_ds());
   r = APICR_TO_ADDR(r, APICR_VERSION);
   ret = HostIF_CopyFromUser(&dummy, r, sizeof dummy);
   set_fs(old_fs);
@@ -2385,7 +2366,7 @@ HostIF_SemaphoreWait(VMDriver *vm,   // IN:
   }

   old_fs = get_fs();
-   set_fs(KERNEL_DS);
+   set_fs(get_ds());

   {
      struct poll_wqueues table;
@@ -2514,7 +2495,7 @@ HostIF_SemaphoreSignal(uint64 *args)  // IN:
   }

   old_fs = get_fs();
-   set_fs(KERNEL_DS);
+   set_fs(get_ds());

   /*
    * Always write sizeof(uint64) bytes. This works fine for eventfd and
@@ -3220,7 +3201,7 @@ HostIF_MapUserMem(VA addr,                  // IN: User memory virtual address

   ASSERT(handle);

-   if (!write_access_ok(p, size)) {
+   if (!access_ok(VERIFY_WRITE, p, size)) {
      printk(KERN_ERR "%s: Couldn't verify write to uva 0x%p with size %"
             FMTSZ"u\n", __func__, p, size);

@@ -107,7 +107,7 @@ prebuild:: ;
 postbuild:: ;

 $(DRIVER_KO): prebuild
-	$(MAKE) -C $(BUILD_DIR) M=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
+	$(MAKE) -C $(BUILD_DIR) SUBDIRS=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) modules
 	$(MAKE) -C $$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) postbuild
@@ -85,12 +85,6 @@ extern unsigned int  vnet_max_qlen;
 #   define compat_kunmap(page) kunmap((page).p)
 #endif

-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0) && defined(VERIFY_WRITE)
-	#define write_access_ok(addr, size) access_ok(VERIFY_WRITE, addr, size)
-#else
-	#define write_access_ok(addr, size) access_ok(addr, size)
-#endif
-
 /*
 *-----------------------------------------------------------------------------
 *
@@ -148,7 +142,7 @@ VNetUserIfMapPtr(VA uAddr,        // IN: pointer to user memory
                 struct page **p, // OUT: locked page
                 void **ptr)      // OUT: kernel mapped pointer
 {
-   if (!write_access_ok((void *)uAddr, size) ||
+   if (!access_ok(VERIFY_WRITE, (void *)uAddr, size) ||
       (((uAddr + size - 1) & ~(PAGE_SIZE - 1)) !=
        (uAddr & ~(PAGE_SIZE - 1)))) {
      return -EINVAL;
Author	SHA1	Message	Date
Michal Kubecek	fac2c93374	vmmon: check presence of file_operations::poll() Commit 11c5ad0ec441 ("eventpoll: switch to ->poll_mask") in v4.18-rc1, made eventpoll switch from ->poll() to ->poll_mask(), resulting in a null pointer dereference as vmmon calls the callback directly without checking its availability. Rather than calling the callback directly (which would result in null pointer dereference), use vfs_poll() wrapper. As this wrapper is only available since 4.18-rc1 cycle as well, provide a copy to use when building against older kernels. Note: even if the commit revealing the problem was reverted in 4.18-rc3 (and is unlikely to go back in the same form) so that vmmon no longer crashes with 4.18 kernel, calling the callback without a check is a bad practice so let's keep the patch in place.	2018-08-20 07:46:13 +02:00
Michal Kubecek	e6804c4f5b	vmmon: fix indirect call with retpoline build Build against kernel with retpoline support issues warning objtool: Task_Switch()+0x425: indirect call found in RETPOLINE build This is because an indirect call in TaskSwitchToMonitor() is encoded using inline assembler so that it bypasses retpoline generation. For this purpose, macro CALL_NOSPEC exists since v4.15-rc8 (and has been backported into some distribution kernels with the rest of retpoline support). Use the macro if available and fallback to the original code if not.	2018-08-20 07:37:40 +02:00
Michal Kubecek	d620eaf4e4	vmmon: fix always_inline attribute usage Function declared with __attribute__((always_inline)) should also be declared as inline, otherwise gcc issues a warning "always_inline function might not be inlinable". It's just cosmetic but getting rid of known harmless warnings makes it easier to spot actual problems. Use the __always_inline macro for LinuxDriverSyncReadTSCs() as this is how always inline functions should be declared in kernel code.	2018-08-20 07:37:33 +02:00
Michal Kubecek	173a605d6f	vmmon: use standard definition of MSR_K7_HWCR_SMMLOCK if available The MSR_K7_HWCR_SMMLOCK macro is defined in mainline since commit 18c71ce9c882 ("x86/CPU/AMD: Add the Secure Encrypted Virtualization CPU feature") in v4.16-rc1.	2018-08-20 07:37:29 +02:00
Theo Bertacchini	6747202f86	modules: remove .cache.mk on make clean Remove .cache.mk inside vmmon-only and vmnet-only when executing "make clean". This file can cause issues when upgrading gcc as make will still look for includes inside older gcc includes directory. File .cache.mk with cache of generated variables is created by build since kernel v4.15-rc1, commit 3298b690b21c ("kbuild: Add a cache for generated variables").	2018-08-20 07:36:26 +02:00
Michal Kubecek	b73189148b	vmmon: quick workaround for objtool warnings As discussed in https://bugzilla.suse.com/show_bug.cgi?id=1059674 the reason for multiple objtool warnings is the fact that vmmon module defines its own Panic() function which never returns. While it is marked as such which is used by the compiler for optimization, there is no way to find this from object file. While this seems innocuous, it might result in problems with unwinder later. The quickest way around is to replace vmmon's own Panic() with standard kernel panic() until a cleaner solution is found.	2018-08-20 07:34:04 +02:00
Michal Kubecek	5c38f36d20	vmmon: use standard definition of CR3_PCID_MASK if available The CR3_PCID_MASK is defined in mainline asm/processor-flags.h since commit 6c690ee1039b ("x86/mm: Split read_cr3() into read_cr3_pa() and __read_cr3()") in v4.13-rc1.	2018-08-20 07:33:44 +02:00
Michal Kubecek	6a61649088	vmmon: use standard definition of MSR_MISC_FEATURES_ENABLES if available The MSR_MISC_FEATURES_ENABLES macro is defined in mainline since commit ab6d9468631a ("x86/msr: Rename MISC_FEATURE_ENABLES to MISC_FEATURES_ENABLES") in v4.12-rc1. The MSR_MISC_FEATURES_ENABLES_CPUID_FAULT macro is defined in mainline since commit e9ea1e7f53b8 ("x86/arch_prctl: Add ARCH_[GET\|SET]_CPUID") in v4.12-rc1.	2018-08-20 07:33:31 +02:00
Michal Kubecek	9cf4254e55	vmnet: use standard definition of PCI_VENDOR_ID_VMWARE_VMXNET3 if available The PCI_DEVICE_ID_VMWARE_VMXNET3 macro is defined in mainline pci_ids.h since commit b1226c7db1d9 ("vmxnet3: Move PCI Id to pci_ids.h") in v4.10-rc1.	2018-08-20 07:33:11 +02:00
Michal Kubecek	5435177e9c	vmnet: use standard definition of PCI_VENDOR_ID_VMWARE if available The PCI_VENDOR_ID_VMWARE macro is defined in mainline pci_ids.h since commit 94e57fea6202 ("PCI: Move PCI_VENDOR_ID_VMWARE to pci_ids.h") in v3.18-rc1.	2018-08-20 07:32:34 +02:00
Michal Kubecek	56b2ba7686	import Player 14.1.3 module sources	2018-08-20 07:28:17 +02:00
Michal Kubecek	7c61516e73	Merge branch 'master' into player	2018-05-27 16:13:48 +02:00
Michal Kubecek	7ee6cd4520	import Player 14.1.2 module sources	2018-05-23 18:14:05 +02:00
Michal Kubecek	5791987f56	Merge branch 'master' into player	2018-04-02 15:37:18 +02:00
Michal Kubecek	0b2713797e	Merge branch 'master' into player	2018-02-04 21:50:37 +01:00
Michal Kubecek	3e445144a1	import Player 14.1.1 module sources	2018-01-12 13:51:34 +01:00
Michal Kubecek	82f569a212	import Player 14.1.0 module sources	2017-12-25 09:47:38 +01:00
Michal Kubecek	455d4d9368	import Player 14.0.0 module sources	2017-09-30 20:31:15 +02:00
Michal Kubecek	027dd56418	import Player 12.5.7 module sources	2017-06-30 19:11:22 +02:00
Michal Kubecek	0e634ffbf1	import Player 12.5.6 module sources	2017-05-31 10:06:51 +02:00
Michal Kubecek	c62c78e908	import Player 12.5.5 module sources	2017-05-31 09:20:00 +02:00
Michal Kubecek	4f648692e4	import Player 12.5.2 module sources	2017-05-31 09:19:26 +02:00