Fix NULL pointer dereference in eventfd read call

Starting with commit 12aceb89b0bc ("eventfd: convert to f_op->read_iter()") in 5.8-rc1, the "read" function pointer in eventfd's file_operations is NULL, "read_iter" is available instead. Use kernel_read() and kernel_write() instead of directly calling the function pointers to handle this correctly.
Fix NX bit handling for Linux 5.8+
2020-09-07 00:30:49 +02:00 · 2020-09-07 00:29:39 +02:00 · 2020-08-20 10:39:56 +02:00 · 2020-08-20 10:13:49 +02:00 · 2020-05-30 02:49:06 +02:00
2 changed files with 34 additions and 2 deletions
@@ -47,7 +47,9 @@
 #include <asm/asm.h>
 #include <asm/io.h>
 #include <asm/page.h>
+#include <asm/tlbflush.h>
 #include <asm/uaccess.h>
+#include <asm/irq_vectors.h>
 #include <linux/capability.h>
 #include <linux/kthread.h>
 #include <linux/wait.h>
@@ -635,7 +637,24 @@ HostIF_FastClockUnlock(int callerID) // IN
 static void *
 MapCrossPage(struct page *p)  // IN:
 {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 8, 0)
   return vmap(&p, 1, VM_MAP, VM_PAGE_KERNEL_EXEC);
+#else
+   /* Starting with 5.8, vmap() always sets the NX bit, but the cross
+    * page needs to be executable. */
+   pte_t *ptes[1];
+   struct vm_struct *area = alloc_vm_area(1UL << PAGE_SHIFT, ptes);
+   if (area == NULL)
+      return NULL;
+
+   set_pte(ptes[0], mk_pte(p, VM_PAGE_KERNEL_EXEC));
+
+   preempt_disable();
+   __flush_tlb_all();
+   preempt_enable();
+
+   return area->addr;
+#endif
 }


@@ -1739,8 +1758,11 @@ HostIF_EstimateLockedPageLimit(const VMDriver* vm,                // IN
 #else
   lockedPages += global_page_state(NR_PAGETABLE);
 #endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 9, 0)
+   /* NR_SLAB_* converted to byte counters in 5.9 */
+   lockedPages += global_node_page_state_pages(NR_SLAB_UNRECLAIMABLE_B);
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
   /* NR_SLAB_* moved from zone to node in 4.13. */
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
   lockedPages += global_node_page_state(NR_SLAB_UNRECLAIMABLE);
 #else
   lockedPages += global_page_state(NR_SLAB_UNRECLAIMABLE);
@@ -2592,7 +2614,11 @@ HostIF_SemaphoreWait(VMDriver *vm,   // IN:
    * reading no bytes (EAGAIN - non blocking fd) or sizeof(uint64).
    */

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)
+   res = kernel_read(file, (char *) &value, sizeof value, &file->f_pos);
+#else
   res = file->f_op->read(file, (char *) &value, sizeof value, &file->f_pos);
+#endif

   if (res == sizeof value) {
      res = MX_WAITNORMAL;
@@ -2709,7 +2735,11 @@ HostIF_SemaphoreSignal(uint64 *args)  // IN:
    * it be present.
    */

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)
+   res = kernel_write(file, (char *) &value, sizeof value, &file->f_pos);
+#else
   res = file->f_op->write(file, (char *) &value, sizeof value, &file->f_pos);
+#endif

   if (res == sizeof value) {
      res = MX_WAITNORMAL;
@@ -81,7 +81,9 @@ extern unsigned int  vnet_max_qlen;
 #   define skb_frag_page(frag) (frag)->page
 #   define skb_frag_size(frag) (frag)->size
 #endif
-#if COMPAT_LINUX_VERSION_CHECK_LT(5, 4, 0)
+#if COMPAT_LINUX_VERSION_CHECK_LT(5, 4, 0) && \
+    !(defined(CONFIG_SUSE_VERSION) && CONFIG_SUSE_VERSION == 15 && \
+      defined(CONFIG_SUSE_PATCHLEVEL) && CONFIG_SUSE_PATCHLEVEL >= 2)
 #   define skb_frag_off(frag) (frag)->page_offset
 #endif
Author	SHA1	Message	Date
Jan Andres	4b33c80b60	Fix NULL pointer dereference in eventfd read call Starting with commit 12aceb89b0bc ("eventfd: convert to f_op->read_iter()") in 5.8-rc1, the "read" function pointer in eventfd's file_operations is NULL, "read_iter" is available instead. Use kernel_read() and kernel_write() instead of directly calling the function pointers to handle this correctly.	2020-09-07 00:30:49 +02:00
Jan Andres	caf715e400	Fix NX bit handling for Linux 5.8+ Do not use vmap() to map the cross page, it needs to be executable and vmap() unconditionally sets the NX bit starting with commit cca98e9f8b5e ("mm: enforce that vmap can't map pages executable") in 5.8-rc1. Emulate previous behavior of vmap() by using alloc_vm_area() and explicitly setting the PTE.	2020-09-07 00:29:39 +02:00
Michal Kubecek	27779212e2	vmmon: include <asm/irq_vectors.h> explicitly After mainline commit 13c01139b171 ("x86/headers: Remove APIC headers from <asm/smp.h>") in 5.9-rc1, APIC headers are no longer included via <asm/smp.h> so that linux/hostif.c will use incorrect fallback definitions of SPURIOUS_APIC_VECTOR and POSTED_INTR_VECTOR even if built against kernel where these are defined. Include <asm/irq_vectors.h> in linux/hostif.c explicitly to avoid that.	2020-08-20 10:39:56 +02:00
Michal Kubecek	fa74eb8166	vmmon: handle change of vmstat slab counters to bytes Mainline commit d42f3245c7e2 ("mm: memcg: convert vmstat slab counters to bytes") in kernel 5.9-rc1 changed vmstat accounting of slab to byte counters. Unfortunately there doesn't seem to be any obvious way to check for this change except version check.	2020-08-20 10:13:49 +02:00
Michal Kubecek	64ec371634	vmnet: work around skb_frag_t build failure for SLE15-SP2 and openSUSE-15.2 The kernels used in (upcoming) SLE15 SP2 and openSUSE Leap 15.2 are based on upstream version 5.3 but have a backport of the skb_frag_t conversion to bio_vec which reached mainline in v5.4-rc1. As we cannot easily check availability compat_skb_frag_off() (which was also added in v5.4-rc1) and have to resort to version check, add an exception for SLE15-SP2 and openSUSE-15.2 kernels.	2020-05-30 02:49:06 +02:00