[PATCH rdma-next 02/15] RDMA/hns: Pin CQ buffer writable to match device DMA write access

[Yishai Hadas <yishaih@nvidia.com>]

alloc_cq_buf() builds its hns_roce_buf_attr with user_access left at its
zero-initialized default. The device writes CQEs into this buffer via
DMA, but with user_access=0, ib_access_writable() is false, so the umem
is pinned without FOLL_WRITE and is not marked dirty on unpin.

Without FOLL_WRITE, pin_user_pages_fast() can hand back a page this
process does not exclusively own (e.g. the shared zero page for an
untouched anonymous mapping) instead of forcing a private copy. The
device is then free to DMA-write CQEs into that shared physical page,
corrupting memory visible to every other mapper of it. Missing the dirty
mark on unpin also risks the device's writes being silently discarded on
reclaim.

Set user_access to IB_ACCESS_LOCAL_WRITE so the CQ buffer is pinned
consistently with how the device actually uses it.

Fixes: 744b7bdfa79e ("RDMA/hns: Support 0 hop addressing for CQE buffer")
Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
---
 drivers/infiniband/hw/hns/hns_roce_cq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c
index 1dd0efb5620d..ae314f136732 100644
--- a/drivers/infiniband/hw/hns/hns_roce_cq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_cq.c
@@ -261,6 +261,7 @@ static int alloc_cq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq,
 	buf_attr.region[0].size = hr_cq->cq_depth * hr_cq->cqe_size;
 	buf_attr.region[0].hopnum = hr_dev->caps.cqe_hop_num;
 	buf_attr.region_count = 1;
+	buf_attr.user_access = IB_ACCESS_LOCAL_WRITE;
 
 	ret = hns_roce_mtr_create(hr_dev, &hr_cq->mtr, &buf_attr,
 				  hr_dev->caps.cqe_ba_pg_sz + PAGE_SHIFT,
-- 
2.18.1