From 25fd8b27ee8d4f59cc2ad99cf67aef4570b82096 Mon Sep 17 00:00:00 2001 From: Abdifatah Suruur Date: Tue, 29 Sep 2026 12:48:43 +0300 Subject: [PATCH] vfio/fsl-mc: prevent read-only region mappings from becoming writable vfio_fsl_mc_mmap() rejects writable mappings of regions without the WRITE flag, but leaves VM_MAYWRITE set. Userspace can map such a region read-only and then upgrade the mapping to writable with mprotect(). Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445), drm/panthor (CVE-2024-53071) and commit a5edadbae57e ("ptp: vmclock: prevent read-only mappings from becoming writable"). Note this is defensive hardening: the fsl-mc bus publishes all device regions with the WRITE flag set, so no device can currently reach the read-only path. The guard costs nothing and keeps the mmap() interface honest if a read-only region ever appears. Fixes: 67247289688d4 ("vfio/fsl-mc: Allow userspace to MMAP fsl-mc device MMIO regions") Reviewed-by: Ioana Ciornei Signed-off-by: Abdifatah Suruur Link: https://lore.kernel.org/r/20260929094848.7439-3-suruurism@gmail.com Signed-off-by: Alex Williamson --- drivers/vfio/fsl-mc/vfio_fsl_mc.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/vfio/fsl-mc/vfio_fsl_mc.c b/drivers/vfio/fsl-mc/vfio_fsl_mc.c index b4c3958201b2..5a6cd78dcc06 100644 --- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c +++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c @@ -403,9 +403,13 @@ static int vfio_fsl_mc_mmap(struct vfio_device *core_vdev, && (vma->vm_flags & VM_READ)) return -EINVAL; - if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE) - && (vma->vm_flags & VM_WRITE)) - return -EINVAL; + /* Prevent read-only region mappings from being upgraded with mprotect() */ + if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE)) { + if (vma->vm_flags & VM_WRITE) + return -EINVAL; + + vm_flags_clear(vma, VM_MAYWRITE); + } vma->vm_private_data = mc_dev;