VMCI: Fix two UVA mapping bugs
authorJorgen Hansen <jhansen@vmware.com>
Wed, 14 Jan 2015 19:10:19 +0000 (11:10 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 25 Jan 2015 17:18:00 +0000 (09:18 -0800)
commita1d88436d53a75e950db15834b3d2f8c0c358fdc
treea1c852aa45acec5f487e0d61706b7dbe57eaea90
parent3f46d81ae1cf8f20f25c39ae1ab3f1b064698361
VMCI: Fix two UVA mapping bugs

(this is a resend of this patch. Originally sent last year, but post
 appears to have been lost)

This change fixes two bugs in the VMCI host driver related to mapping
the notify boolean from user space into kernel space:
- the actual UVA was rounded up to the next page boundary - resulting
  in memory corruption in the calling process whenever notifications
  would be signalled. This has been fixed by just removing the
  PAGE_ALIGN part, since get_user_pages_fast can figure this out on
  its own
- the mapped page wasn't stored anywhere, so it wasn't unmapped and
  put back when a VMCI context was destroyed. Fixed this by
  remembering the page.

Acked-by: Andy King <acking@vmware.com>
Acked-by: Darius Davis <darius@vmware.com>
Signed-off-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/vmw_vmci/vmci_driver.c
drivers/misc/vmw_vmci/vmci_host.c