[PATCH] RDMA/mlx4: Do not allow the user to write to the clock page

[PATCH] RDMA/mlx4: Do not allow the user to write to the clock page

[Jiale Yao]

mlx4_ib_mmap() maps the internal clock page to userspace through
rdma_user_mmap_io(), which does not restrict write access. Userspace can
request PROT_WRITE directly, or upgrade a read-only mapping later with
mprotect() because VM_MAYWRITE remains set.

Reject VM_WRITE and clear VM_MAYWRITE, applying the same read-only policy
as commit c660133c339f ("RDMA/mlx5: Do not allow the user to write to the
clock page"). The rdma-core mlx4 provider requests this mapping with
PROT_READ, so its existing behavior is unchanged.

Fixes: 52033cfb5aab ("IB/mlx4: Add mmap call to map the hardware clock")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/infiniband/hw/mlx4/main.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 7266a6141944..6646a2633511 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1169,6 +1169,10 @@ static int mlx4_ib_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
 		struct mlx4_clock_params params;
 		int ret;
 
+		if (vma->vm_flags & VM_WRITE)
+			return -EPERM;
+		vm_flags_clear(vma, VM_MAYWRITE);
+
 		ret = mlx4_get_internal_clock_params(dev->dev, &params);
 		if (ret)
 			return ret;
-- 
2.34.1

Re: [PATCH] RDMA/mlx4: Do not allow the user to write to the clock page

[Leon Romanovsky]

On Sat, Sep 26, 2026 at 07:11:50PM +0800, Jiale Yao wrote:
> mlx4_ib_mmap() maps the internal clock page to userspace through
> rdma_user_mmap_io(), which does not restrict write access. Userspace can
> request PROT_WRITE directly, or upgrade a read-only mapping later with
> mprotect() because VM_MAYWRITE remains set.
> 
> Reject VM_WRITE and clear VM_MAYWRITE, applying the same read-only policy
> as commit c660133c339f ("RDMA/mlx5: Do not allow the user to write to the
> clock page"). The rdma-core mlx4 provider requests this mapping with
> PROT_READ, so its existing behavior is unchanged.
> 
> Fixes: 52033cfb5aab ("IB/mlx4: Add mmap call to map the hardware clock")
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/infiniband/hw/mlx4/main.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
> index 7266a6141944..6646a2633511 100644
> --- a/drivers/infiniband/hw/mlx4/main.c
> +++ b/drivers/infiniband/hw/mlx4/main.c
> @@ -1169,6 +1169,10 @@ static int mlx4_ib_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
>  		struct mlx4_clock_params params;
>  		int ret;
>  
> +		if (vma->vm_flags & VM_WRITE)

It needs to be:
               if (vma->vm_flags & (VM_WRITE | VM_EXEC))

I fixed it locally.

Thanks

> +			return -EPERM;
> +		vm_flags_clear(vma, VM_MAYWRITE);
> +
>  		ret = mlx4_get_internal_clock_params(dev->dev, &params);
>  		if (ret)
>  			return ret;
> -- 
> 2.34.1
> 

Re: [PATCH] RDMA/mlx4: Do not allow the user to write to the clock page

[Leon Romanovsky]

On Sat, 26 Sep 2026 19:11:50 +0800, Jiale Yao wrote:
> mlx4_ib_mmap() maps the internal clock page to userspace through
> rdma_user_mmap_io(), which does not restrict write access. Userspace can
> request PROT_WRITE directly, or upgrade a read-only mapping later with
> mprotect() because VM_MAYWRITE remains set.
> 
> Reject VM_WRITE and clear VM_MAYWRITE, applying the same read-only policy
> as commit c660133c339f ("RDMA/mlx5: Do not allow the user to write to the
> clock page"). The rdma-core mlx4 provider requests this mapping with
> PROT_READ, so its existing behavior is unchanged.
> 
> [...]

Applied, thanks!

[1/1] RDMA/mlx4: Do not allow the user to write to the clock page
      https://git.kernel.org/rdma/rdma/c/33db1d9683b8fb

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>