From: Ira Weiny <ira.weiny@intel.com>
Date: Sun, 9 Apr 2017 17:17:24 +0000 (-0700)
Subject: IB/hfi: Protect against writable mmap
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=12220267645cb7d1f3f699218e0098629e932e1f;p=openwrt%2Fstaging%2Fblogic.git

IB/hfi: Protect against writable mmap

The device/port status is not intended to be changed from user space.
Prevent a user from mapping them as write or execute.

Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
---

diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index 60598867f948..3d9bce4bfcc7 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -597,6 +597,10 @@ static int hfi1_file_mmap(struct file *fp, struct vm_area_struct *vma)
 		vmf = 1;
 		break;
 	case STATUS:
+		if (flags & (unsigned long)(VM_WRITE | VM_EXEC)) {
+			ret = -EPERM;
+			goto done;
+		}
 		memaddr = kvirt_to_phys((void *)dd->status);
 		memlen = PAGE_SIZE;
 		flags |= VM_IO | VM_DONTEXPAND;