diff options
| author | Jiale Yao <yaojiale02@163.com> | 2026-09-26 19:26:11 +0800 |
|---|---|---|
| committer | Leon Romanovsky <leon@kernel.org> | 2026-09-29 15:05:38 -0400 |
| commit | 1c5335a6902639596a795705349da7f76027e103 (patch) | |
| tree | c5c4cec1301f9c14cb5d78caaf33c1533bebb4d0 /tools/lib/python | |
| parent | 33db1d9683b8fb00bc233d0bea093e694ed9afc5 (diff) | |
RDMA/cxgb4: Do not allow userspace to write the status page
The device status page is shared by all userspace contexts and contains
db_off, which the driver updates to control doorbell flow. The rdma-core
provider maps it with PROT_READ, but c4iw_mmap() passes the requested page
protection through when handling CXGB4_MMAP_CONTIG.
A process can therefore request PROT_WRITE directly or later upgrade a
read-only mapping with mprotect() because VM_MAYWRITE remains set. This
lets userspace alter device-wide flow-control state seen by the kernel and
other contexts.
Reject initially writable mappings and clear VM_MAYWRITE before mapping the
page. This preserves the existing read-only userspace ABI.
Fixes: 05eb23893c2c ("cxgb4/iw_cxgb4: Doorbell Drop Avoidance Bug Fixes")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Link: https://patch.msgid.link/20260926112611.3214382-1-yaojiale02@163.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions