linux-toradex.git/drivers/misc/vmw_vmci, branch v6.1

misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()

2022-11-09T14:40:03+00:00

`struct vmci_event_qp` allocated by qp_notify_peer() contains padding,
which may carry uninitialized data to the userspace, as observed by
KMSAN:

  BUG: KMSAN: kernel-infoleak in instrument_copy_to_user ./include/linux/instrumented.h:121
   instrument_copy_to_user ./include/linux/instrumented.h:121
   _copy_to_user+0x5f/0xb0 lib/usercopy.c:33
   copy_to_user ./include/linux/uaccess.h:169
   vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:431
   vmci_host_unlocked_ioctl+0x33d/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:925
   vfs_ioctl fs/ioctl.c:51
  ...

  Uninit was stored to memory at:
   kmemdup+0x74/0xb0 mm/util.c:131
   dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:271
   vmci_datagram_dispatch+0x4f8/0xfc0 drivers/misc/vmw_vmci/vmci_datagram.c:339
   qp_notify_peer+0x19a/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1479
   qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662
   qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750
   vmci_qp_broker_alloc+0x96/0xd0 drivers/misc/vmw_vmci/vmci_queue_pair.c:1940
   vmci_host_do_alloc_queuepair drivers/misc/vmw_vmci/vmci_host.c:488
   vmci_host_unlocked_ioctl+0x24fd/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:927
  ...

  Local variable ev created at:
   qp_notify_peer+0x54/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1456
   qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662
   qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750

  Bytes 28-31 of 48 are uninitialized
  Memory access of size 48 starts at ffff888035155e00
  Data copied to user address 0000000020000100

Use memset() to prevent the infoleaks.

Also speculatively fix qp_notify_peer_local(), which may suffer from the
same problem.

Reported-by: syzbot+39be4da489ed2493ba25@syzkaller.appspotmail.com
Cc: stable 
Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
Signed-off-by: Alexander Potapenko 
Reviewed-by: Vishnu Dasa 
Link: https://lore.kernel.org/r/20221104175849.2782567-1-glider@google.com
Signed-off-by: Greg Kroah-Hartman

misc/vmw_vmci: Use kmap_local_page() in vmci_queue_pair.c

2022-09-09T08:22:32+00:00

kmap() is being deprecated in favor of kmap_local_page().

There are two main problems with kmap(): (1) It comes with an overhead as
the mapping space is restricted and protected by a global lock for
synchronization and (2) it also requires global TLB invalidation when the
kmap’s pool wraps and it might block when the mapping space is fully
utilized until a slot becomes available.

With kmap_local_page() the mappings are per thread, CPU local, can take
page faults, and can be called from any context (including interrupts).
It is faster than kmap() in kernels with HIGHMEM enabled. Furthermore,
the tasks can be preempted and, when they are scheduled to run again, the
kernel virtual addresses are restored and still valid.

Since its use in vmci_queue_pair.c is safe everywhere, replace kmap() with
kmap_local_page().

Cc: "Venkataramanan, Anirudh" 
Suggested-by: Ira Weiny 
Signed-off-by: Fabio M. De Francesco 
Link: https://lore.kernel.org/r/20220901135714.16481-1-fmdefrancesco@gmail.com
Signed-off-by: Greg Kroah-Hartman

VMCI: Add support for ARM64

2022-04-24T15:32:14+00:00

Add support for ARM64 architecture so that the driver can now be built
and VMCI device can be used.

Update Kconfig file to allow the driver to be built on ARM64 as well.
Fail vmci_guest_probe_device() on ARM64 if the device does not support
MMIO register access.  Lastly, add virtualization specific barriers
which map to actual memory barrier instructions on ARM64, because it
is required in case of ARM64 for queuepair (de)queuing.

Reviewed-by: Bryan Tan 
Reviewed-by: Cyprien Laplace 
Signed-off-by: Vishnu Dasa 
Link: https://lore.kernel.org/r/20220414193316.14356-1-vdasa@vmware.com
Signed-off-by: Greg Kroah-Hartman

misc: vmw_vmci: replace usage of found with dedicated list iterator variable

2022-04-24T15:24:09+00:00

To move the list iterator variable into the list_for_each_entry_*()
macro in the future it should be avoided to use the list iterator
variable after the loop body.

To *never* use the list iterator variable after the loop it was
concluded to use a separate iterator variable instead of a
found boolean [1].

This removes the need to use a found variable and simply checking if
the variable was set, can determine if the break/goto was hit.

Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/
Signed-off-by: Jakob Koschel 
Link: https://lore.kernel.org/r/20220324073151.66305-1-jakobkoschel@gmail.com
Signed-off-by: Greg Kroah-Hartman

VMCI: Release notification_bitmap in error path

2022-03-18T12:47:48+00:00

notification_bitmap may not be released when VMCI_CAPS_DMA_DATAGRAM
capability is missing from the device.  Add missing
'err_free_notification_bitmap' label and use it instead of
'err_free_data_buffers' to avoid this.

Fixes: eed2298d9360 ("VMCI: dma dg: detect DMA datagram capability")
Reported-by: Dan Carpenter 
Reviewed-by: Bryan Tan 
Reviewed-by: Rajesh Jalisatgi 
Signed-off-by: Vishnu Dasa 
Link: https://lore.kernel.org/r/20220318060040.31621-1-vdasa@vmware.com
Signed-off-by: Greg Kroah-Hartman

VMCI: Check exclusive_vectors when freeing interrupt 1

2022-03-18T12:47:34+00:00

free_irq() may be called to free an interrupt that was not
allocated.  Add missing 'if' statement to check for
exclusive_vectors when freeing interrupt 1.

Fixes: cc68f2177fcb ("VMCI: dma dg: register dummy IRQ handlers for DMA datagrams")
Reported-by: Dan Carpenter 
Reviewed-by: Bryan Tan 
Reviewed-by: Rajesh Jalisatgi 
Signed-off-by: Vishnu Dasa 
Link: https://lore.kernel.org/r/20220318055843.30606-1-vdasa@vmware.com
Signed-off-by: Greg Kroah-Hartman

VMCI: Fix some error handling paths in vmci_guest_probe_device()

2022-02-25T10:55:01+00:00

The 'err_remove_vmci_dev_g' error label is not at the right place.
This could lead to un-released resource.

There is also a missing label. If pci_alloc_irq_vectors() fails, the
previous vmci_event_subscribe() call must be undone.

Acked-by: Vishnu Dasa 
Signed-off-by: Christophe JAILLET 
Link: https://lore.kernel.org/r/959218ce3b135197946d85cd9453551cd04fa5da.1645734041.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman

VMCI: No need to clear memory after a dma_alloc_coherent() call

2022-02-25T10:55:01+00:00

dma_alloc_coherent() already clear the allocated memory, there is no need
to explicitly call memset().
This saves a few cycles and a few lines of code.

Acked-by: Vishnu Dasa 
Signed-off-by: Christophe JAILLET 
Link: https://lore.kernel.org/r/3e8c0bfaa77500e22d6c90f249da1c53dbae716e.1645734041.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman

VMCI: Fix the description of vmci_check_host_caps()

2022-02-25T10:55:01+00:00

vmci_check_host_caps() doesn't return a bool but an int.
Fix the description accordingly.

Fixes: 782f24453536 ("VMCI: fix error handling path when registering guest driver")
Acked-by: Vishnu Dasa 
Signed-off-by: Christophe JAILLET 
Link: https://lore.kernel.org/r/c181bec88aab1145d3868d61b7e52d53923f8206.1645734041.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman

VMCI: dma dg: add support for DMA datagrams receive

2022-02-08T11:15:59+00:00

Use the DMA based receive operation instead of the ioread8_rep
based datagram receive when DMA datagrams are supported.

In the receive operation, configure the header to point to the
page aligned VMCI_MAX_DG_SIZE part of the receive buffer
using s/g configuration for the header. This ensures that the
existing dispatch routine can be used with little modification.
Initiate the receive by writing the lower 32 bit of the buffer
to the VMCI_DATA_IN_LOW_ADDR register, and wait for the busy
flag to be changed by the device using a wait queue.

The existing dispatch routine for received  datagrams is reused
for the DMA datagrams with a few modifications:
- the receive buffer is always the maximum size for DMA datagrams
  (IO ports would try with a shorter buffer first to reduce
  overhead of the ioread8_rep operation).
- for DMA datagrams, datagrams are provided contiguous in the
  buffer as opposed to IO port datagrams, where they can start
  on any page boundary

Reviewed-by: Vishnu Dasa 
Signed-off-by: Jorgen Hansen 
Link: https://lore.kernel.org/r/20220207102725.2742-9-jhansen@vmware.com
Signed-off-by: Greg Kroah-Hartman