kernel/linux.git/drivers/misc/vmw_vmci, branch v3.16.76

VMCI: Fix integer overflow in VMCI handle arrays

2019-10-31T22:14:57+00:00

commit 1c2eb5b2853c9f513690ba6b71072d8eb65da16a upstream. The VMCI handle array has an integer overflow in vmci_handle_arr_append_entry when it tries to expand the array. This can be triggered from a guest, since the doorbell link hypercall doesn't impose a limit on the number of doorbell handles that a VM can create in the hypervisor, and these handles are stored in a handle array. In this change, we introduce a mandatory max capacity for handle arrays/lists to avoid excessive memory usage. Signed-off-by: Vishnu Dasa Reviewed-by: Adit Ranadive Reviewed-by: Jorgen Hansen Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings

VMCI: Resource wildcard match fixed

2019-02-11T17:53:25+00:00

commit 11924ba5e671d6caef1516923e2bd8c72929a3fe upstream. When adding a VMCI resource, the check for an existing entry would ignore that the new entry could be a wildcard. This could result in multiple resource entries that would match a given handle. One disastrous outcome of this is that the refcounting used to ensure that delayed callbacks for VMCI datagrams have run before the datagram is destroyed can be wrong, since the refcount could be increased on the duplicate entry. This in turn leads to a use after free bug. This issue was discovered by Hangbin Liu using KASAN and syzkaller. Fixes: bc63dedb7d46 ("VMCI: resource object implementation") Reported-by: Hangbin Liu Reviewed-by: Adit Ranadive Reviewed-by: Vishnu Dasa Signed-off-by: Jorgen Hansen Signed-off-by: Greg Kroah-Hartman [bwh: Backported to 3.16: Drop the version change.] Signed-off-by: Ben Hutchings

vmci: type promotion bug in qp_host_get_user_memory()

2018-12-16T22:08:12+00:00

commit 7fb2fd4e25fc1fb10dcb30b5519de257cfeae84c upstream. The problem is that if get_user_pages_fast() fails and returns a negative error code, it gets type promoted to a high positive value and treated as a success. Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.") Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings

vmw_vmci: Use pci_enable_msix_exact() instead of pci_enable_msix()

2014-02-28T23:24:32+00:00

As result of deprecation of MSI-X/MSI enablement functions pci_enable_msix() and pci_enable_msi_block() all drivers using these two interfaces need to be updated to use the new pci_enable_msi_range() or pci_enable_msi_exact() and pci_enable_msix_range() or pci_enable_msix_exact() interfaces. Signed-off-by: Alexander Gordeev Cc: Greg Kroah-Hartman Cc: Andy King Cc: Dmitry Torokhov Cc: linux-pci@vger.kernel.org Signed-off-by: Greg Kroah-Hartman

VMCI: fix error handling path when registering guest driver

2014-01-10T00:16:15+00:00

When host capabilities check failed or when we were unable to register doorbell bitmap we were forgetting to set error code and were returning 0 which would make upper layers believe that probe was successful. Reported-by: Julia Lawall Acked-by: Andy King Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

vmw_vmci: Convert driver to use get_user_pages_fast()

2013-10-06T01:04:55+00:00

Convert vmci_host_setup_notify() and qp_host_get_user_memory() to use get_user_pages_fast() instead of get_user_pages(). Note that qp_host_get_user_memory() was using mmap_sem for writing without an apparent reason. CC: Arnd Bergmann Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman

VMCI: fix to pass correct device identity to free_irq()

2013-09-26T20:47:36+00:00

free_irq() expects the same device identity that was passed to corresponding request_irq(), otherwise the IRQ is not freed. Signed-off-by: Wei Yongjun Acked-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

VMCI: Add support for virtual IOMMU

2013-08-28T04:42:12+00:00

This patch adds support for virtual IOMMU to the vmci module. We switch to DMA consistent mappings for guest queuepair and doorbell pages that are passed to the device. We still allocate each page individually, since there's no guarantee that we'll get a contiguous block of physical for an entire queuepair (especially since we allow up to 128 MiB!). Also made the split between guest and host in the kernelIf struct much clearer. Now it's obvious which fields are which. Acked-by: George Zhang Acked-by: Aditya Sarwade Signed-off-by: Andy King Signed-off-by: Greg Kroah-Hartman

VMCI: Remove non-blocking/pinned queuepair support

2013-08-28T04:42:12+00:00

We added this for a special case that doesn't exist on Linux. Remove the non-blocking/pinned queuepair code and simplify the driver in preparation for adding virtual IOMMU support. Acked-by: Aditya Sarwade Signed-off-by: Andy King Signed-off-by: Greg Kroah-Hartman

Hoist memcpy_fromiovec/memcpy_toiovec into lib/

2013-05-20T00:54:22+00:00

ERROR: "memcpy_fromiovec" [drivers/vhost/vhost_scsi.ko] undefined! That function is only present with CONFIG_NET. Turns out that crypto/algif_skcipher.c also uses that outside net, but it actually needs sockets anyway. In addition, commit 6d4f0139d642c45411a47879325891ce2a7c164a added CONFIG_NET dependency to CONFIG_VMCI for memcpy_toiovec, so hoist that function and revert that commit too. socket.h already includes uio.h, so no callers need updating; trying only broke things fo x86_64 randconfig (thanks Fengguang!). Reported-by: Randy Dunlap Acked-by: David S. Miller Acked-by: Michael S. Tsirkin Signed-off-by: Rusty Russell