Re: [PATCH] RDMA/mlx4: Do not allow the user to write to the clock page

[Leon Romanovsky]

On Sat, Sep 26, 2026 at 07:11:50PM +0800, Jiale Yao wrote:
> mlx4_ib_mmap() maps the internal clock page to userspace through
> rdma_user_mmap_io(), which does not restrict write access. Userspace can
> request PROT_WRITE directly, or upgrade a read-only mapping later with
> mprotect() because VM_MAYWRITE remains set.
> 
> Reject VM_WRITE and clear VM_MAYWRITE, applying the same read-only policy
> as commit c660133c339f ("RDMA/mlx5: Do not allow the user to write to the
> clock page"). The rdma-core mlx4 provider requests this mapping with
> PROT_READ, so its existing behavior is unchanged.
> 
> Fixes: 52033cfb5aab ("IB/mlx4: Add mmap call to map the hardware clock")
> Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
> ---
>  drivers/infiniband/hw/mlx4/main.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
> index 7266a6141944..6646a2633511 100644
> --- a/drivers/infiniband/hw/mlx4/main.c
> +++ b/drivers/infiniband/hw/mlx4/main.c
> @@ -1169,6 +1169,10 @@ static int mlx4_ib_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
>  		struct mlx4_clock_params params;
>  		int ret;
>  
> +		if (vma->vm_flags & VM_WRITE)

It needs to be:
               if (vma->vm_flags & (VM_WRITE | VM_EXEC))

I fixed it locally.

Thanks

> +			return -EPERM;
> +		vm_flags_clear(vma, VM_MAYWRITE);
> +
>  		ret = mlx4_get_internal_clock_params(dev->dev, &params);
>  		if (ret)
>  			return ret;
> -- 
> 2.34.1
>