[PATCH] uv_mmtimer: keep the mapping of the RTC read-only

[PATCH] uv_mmtimer: keep the mapping of the RTC read-only

[Greg Kroah-Hartman]

From: Josef Bacik <josef@toxicpanda.com>

uv_mmtimer_mmap() refuses a writable mapping of the page with the real time
clock, which is a page of registers of the UV hub.  It leaves VM_MAYWRITE
set, though.  Who has opened the device for reading and writing can map the
page shared and read-only and then make the mapping writable with
mprotect(), which gives him the access to the hub registers that the check
is there to prevent.

Clear VM_MAYWRITE.  mprotect(PROT_WRITE) now fails with -EACCES on such a
mapping, on a private one too.

Fixes: fbd8ae106850 ("drivers/char/uv_mmtimer.c: add memory mapped RTC driver for UV")
Cc: stable <stable@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/char/uv_mmtimer.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/char/uv_mmtimer.c b/drivers/char/uv_mmtimer.c
index 956ebe2080a5..1cced9ef745b 100644
--- a/drivers/char/uv_mmtimer.c
+++ b/drivers/char/uv_mmtimer.c
@@ -157,6 +157,9 @@ static int uv_mmtimer_mmap(struct file *file, struct vm_area_struct *vma)
 	if (PAGE_SIZE > (1 << 16))
 		return -ENOSYS;
 
+	/* Don't let mprotect() add the permission afterwards. */
+	vm_flags_clear(vma, VM_MAYWRITE);
+
 	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
 
 	uv_mmtimer_addr = UV_LOCAL_MMR_BASE | UVH_RTC;
-- 
2.56.0