vmmon: check presence of file_operations::poll()

Commit 11c5ad0ec441 ("eventpoll: switch to ->poll_mask") in v4.18-rc1, made
eventpoll switch from ->poll() to ->poll_mask(), resulting in a null
pointer dereference as vmmon calls the callback directly without checking
its availability.

Rather than calling the callback directly (which would result in null
pointer dereference), use vfs_poll() wrapper. As this wrapper is only
available since 4.18-rc1 cycle as well, provide a copy to use when building
against older kernels.

Note: even if the commit revealing the problem was reverted in 4.18-rc3
(and is unlikely to go back in the same form) so that vmmon no longer
crashes with 4.18 kernel, calling the callback without a check is a bad
practice so let's keep the patch in place.

RETIRED

@@ -1,7 +0,0 @@
-*-----------------------------------------------------------------------------
-* Branch workstation-15.0.0 has been retired on 2018-12-26 and has not been
-* receiving any updates since. Please switch to latest 15.0.x version
-* available.
-*
-* Latest kernel version this branch is intended to work with is 4.19.
-*-----------------------------------------------------------------------------

vmmon-only/common/task.c

@@ -1092,8 +1092,9 @@ TaskSetCrossGDTVMM(BSVMM_GDTInit *gdt)
  * TaskSetCrossGDTHost --
  *
  *      Initializes the host portion of the crossGDT by copying it directly
- *      from the host kernel's GDT. We assume that all the host segments we
- *      will ever need come from the first page of the host's GDT.
+ *      from the host kernel's GDT. We assume that all the host segments
+ *      we will ever need come from the first page of the host's GDT and
+ *      precede the lowest segment needed by the monitor.
  *
  * Results:
  *      TRUE on success, FALSE otherwise.
@@ -1105,17 +1106,30 @@ TaskSetCrossGDTVMM(BSVMM_GDTInit *gdt)
  */
 
 static void
-TaskSetCrossGDTHost(void)
+TaskSetCrossGDTHost(const BSVMM_GDTInit *gdt)
 {
    unsigned len;
    DTR64 hostGDT;
+   unsigned i;
+   /* Copy descriptors up to at most the size of the CrossGDT. */
+   unsigned minVMMIndex = sizeof(CrossGDT) / sizeof(Descriptor);
+
    /*
     * All copied host segment descriptors will come from the first page of
-    * the host kernel GDT.
+    * the host kernel GDT and precede the first monitor segment descriptor.
     */
+   ASSERT_ON_COMPILE(sizeof(CrossGDT) % sizeof(Descriptor) == 0);
    ASSERT(HostIF_GlobalLockIsHeld());
+   for (i = 0; i < ARRAYSIZE(gdt->entries); i++) {
+      const BSVMM_GDTInitEntry *entry = &gdt->entries[i];
+      if (entry->present == 1) {
+         minVMMIndex = MIN(entry->index, minVMMIndex);
+      }
+   }
    TaskSaveGDT(&hostGDT);
-   len = MIN((unsigned)hostGDT.limit + 1, sizeof(CrossGDT));
+   /* PR 2142795: Only copy up to at most the monitor's first descriptor. */
+   len = MIN((unsigned)hostGDT.limit + 1, minVMMIndex * sizeof(Descriptor));
+   ASSERT(len <= sizeof(CrossGDT));
    memcpy(crossGDT->gdtes, (void*)HOST_KERNEL_LA_2_VA((LA)hostGDT.offset), len);
 }
 
@@ -1157,7 +1171,7 @@ Task_CreateCrossGDT(BSVMM_GDTInit *gdt)
          return FALSE;
       }
       memset(crossGDT, 0, sizeof *crossGDT);
-      TaskSetCrossGDTHost();
+      TaskSetCrossGDTHost(gdt);
    }
 
    populatedCrossGDT = TaskSetCrossGDTVMM(gdt);