Commit c660133c authored by Jason Gunthorpe's avatar Jason Gunthorpe

RDMA/mlx5: Do not allow the user to write to the clock page

The intent of this VMA was to be read-only from user space, but the
VM_MAYWRITE masking was missed, so mprotect could make it writable.

Cc: stable@vger.kernel.org
Fixes: 5c99eaec ("IB/mlx5: Mmap the HCA's clock info to user-space")
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
Reviewed-by: default avatarHaggai Eran <haggaie@mellanox.com>
Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
parent 7249c8ea
...@@ -2068,6 +2068,7 @@ static int mlx5_ib_mmap_clock_info_page(struct mlx5_ib_dev *dev, ...@@ -2068,6 +2068,7 @@ static int mlx5_ib_mmap_clock_info_page(struct mlx5_ib_dev *dev,
if (vma->vm_flags & VM_WRITE) if (vma->vm_flags & VM_WRITE)
return -EPERM; return -EPERM;
vma->vm_flags &= ~VM_MAYWRITE;
if (!dev->mdev->clock_info_page) if (!dev->mdev->clock_info_page)
return -EOPNOTSUPP; return -EOPNOTSUPP;
...@@ -2233,6 +2234,7 @@ static int mlx5_ib_mmap(struct ib_ucontext *ibcontext, struct vm_area_struct *vm ...@@ -2233,6 +2234,7 @@ static int mlx5_ib_mmap(struct ib_ucontext *ibcontext, struct vm_area_struct *vm
if (vma->vm_flags & VM_WRITE) if (vma->vm_flags & VM_WRITE)
return -EPERM; return -EPERM;
vma->vm_flags &= ~VM_MAYWRITE;
/* Don't expose to user-space information it shouldn't have */ /* Don't expose to user-space information it shouldn't have */
if (PAGE_SIZE > 4096) if (PAGE_SIZE > 4096)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment