diff options
| author | Selvin Xavier <selvin.xavier@broadcom.com> | 2026-07-21 04:54:40 -0700 |
|---|---|---|
| committer | Leon Romanovsky <leonro@nvidia.com> | 2026-07-22 12:20:51 -0400 |
| commit | 9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16 (patch) | |
| tree | 3e0cf3375bf0d08cf6c9d2da19c6d60f993a02a1 /drivers/infiniband/hw/bnxt_re | |
| parent | 0e8e94c15091041ea8910cbfcade5a9c7cfe3f90 (diff) | |
| download | linux-next-9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16.tar.gz linux-next-9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16.zip | |
RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap
flags, but a read-only mapping can still retain VM_MAYWRITE. nd later
be upgraded with mprotect(PROT_WRITE). This can bypass the write check
that only runs at mmap time.
Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page
branch, matching the existing policy that userspace writes are not
expected for these pages.
Fixes: ea222485788208 ("RDMA/bnxt_re: Update alloc_page uapi for pacing")
Suggested-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Link: https://patch.msgid.link/20260721115440.24021-5-selvin.xavier@broadcom.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Diffstat (limited to 'drivers/infiniband/hw/bnxt_re')
| -rw-r--r-- | drivers/infiniband/hw/bnxt_re/ib_verbs.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c index adc693736769..a2a354a0fbef 100644 --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c @@ -4985,11 +4985,13 @@ int bnxt_re_mmap(struct ib_ucontext *ib_uctx, struct vm_area_struct *vma) case BNXT_RE_MMAP_DBR_PAGE: case BNXT_RE_MMAP_TOGGLE_PAGE: /* Driver doesn't expect write access for user space */ - if (vma->vm_flags & VM_WRITE) + if (vma->vm_flags & VM_WRITE) { ret = -EFAULT; - else + } else { + vm_flags_clear(vma, VM_MAYWRITE); ret = vm_insert_page(vma, vma->vm_start, virt_to_page((void *)bnxt_entry->mem_offset)); + } break; default: ret = -EINVAL; |