releases/4.9.30/pci-only-allow-wc-mmap-on-prefetchable-resources.patch

   1 From cef4d02305a06be581bb7f4353446717a1b319ec Mon Sep 17 00:00:00 2001
   2 From: David Woodhouse <dwmw@amazon.co.uk>
   3 Date: Wed, 12 Apr 2017 13:25:52 +0100
   4 Subject: PCI: Only allow WC mmap on prefetchable resources
   5
   6 From: David Woodhouse <dwmw@amazon.co.uk>
   7
   8 commit cef4d02305a06be581bb7f4353446717a1b319ec upstream.
   9
  10 The /proc/bus/pci mmap interface allows the user to specify whether they
  11 want WC or not.  Don't let them do so on non-prefetchable BARs.
  12
  13 Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
  14 Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
  15 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  16
  17 ---
  18  drivers/pci/proc.c |   13 ++++++++-----
  19  1 file changed, 8 insertions(+), 5 deletions(-)
  20
  21 --- a/drivers/pci/proc.c
  22 +++ b/drivers/pci/proc.c
  23 @@ -231,7 +231,7 @@ static int proc_bus_pci_mmap(struct file
  24  {
  25         struct pci_dev *dev = PDE_DATA(file_inode(file));
  26         struct pci_filp_private *fpriv = file->private_data;
  27 -       int i, ret, write_combine, res_bit;
  28 +       int i, ret, write_combine = 0, res_bit;
  29
  30         if (!capable(CAP_SYS_RAWIO))
  31                 return -EPERM;
  32 @@ -251,10 +251,13 @@ static int proc_bus_pci_mmap(struct file
  33         if (i >= PCI_ROM_RESOURCE)
  34                 return -ENODEV;
  35
  36 -       if (fpriv->mmap_state == pci_mmap_mem)
  37 -               write_combine = fpriv->write_combine;
  38 -       else
  39 -               write_combine = 0;
  40 +       if (fpriv->mmap_state == pci_mmap_mem &&
  41 +           fpriv->write_combine) {
  42 +               if (dev->resource[i].flags & IORESOURCE_PREFETCH)
  43 +                       write_combine = 1;
  44 +               else
  45 +                       return -EINVAL;
  46 +       }
  47         ret = pci_mmap_page_range(dev, vma,
  48                                   fpriv->mmap_state, write_combine);
  49         if (ret < 0)