[PATCH] vhost/vringh: Fix IOTLB permission in putu16_iotlb()

[PATCH] vhost/vringh: Fix IOTLB permission in putu16_iotlb()

[Dudu Lu]

putu16_iotlb() performs a write operation (__put_user / WRITE_ONCE)
but requests IOTLB translation with VHOST_MAP_RO (read-only
permission).  This means the IOTLB lookup succeeds only if the page
has read permission, ignoring write permission entirely.  A page
mapped read-only in the IOTLB would incorrectly allow the write,
while a page mapped write-only would incorrectly deny it.

The neighbouring getu16_iotlb() correctly uses VHOST_MAP_RO for its
read operation, and the copydesc write path (putdesc_iotlb) correctly
uses VHOST_MAP_WO, confirming this is a copy-paste error.

Fix by changing VHOST_MAP_RO to VHOST_MAP_WO to match the write
semantics of putu16_iotlb().

Fixes: 0ea9ee430111 ("vhost/vringh: add IOTLB support")
Signed-off-by: Dudu Lu <phx0fer@gmail.com>
---
 drivers/vhost/vringh.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 9066f9f12ba1..e6ca7e0824f9 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -1244,7 +1244,7 @@ static inline int putu16_iotlb(const struct vringh *vrh,
 
 	/* Atomic write is needed for putu16 */
 	ret = iotlb_translate(vrh, (u64)(uintptr_t)p, sizeof(*p),
-			      NULL, &ivec, VHOST_MAP_RO);
+			      NULL, &ivec, VHOST_MAP_WO);
 	if (ret < 0)
 		return ret;
 
-- 
2.39.3 (Apple Git-145)