From 420bed9131dbbe37abe9d6b32af51219875811e0 Mon Sep 17 00:00:00 2001 From: Abdifatah Suruur Date: Tue, 29 Sep 2026 12:48:42 +0300 Subject: [PATCH] vfio/platform: prevent read-only region mappings from becoming writable vfio_platform_mmap() rejects writable mappings of regions without the WRITE flag, but leaves VM_MAYWRITE set. Userspace can map such a region read-only and then upgrade the mapping to writable with mprotect(). Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445), drm/panthor (CVE-2024-53071) and commit a5edadbae57e ("ptp: vmclock: prevent read-only mappings from becoming writable"). Note this is defensive hardening: no in-tree platform driver currently publishes a region without the WRITE flag. The guard costs nothing and keeps the mmap() interface honest if a read-only region ever appears. Fixes: fad4d5b1f042 ("vfio/platform: support MMAP of MMIO regions") Reviewed-by: Mostafa Saleh Reviewed-by: Eric Auger Reviewed-by: Pranjal Shrivastava Signed-off-by: Abdifatah Suruur Link: https://lore.kernel.org/r/20260929094848.7439-2-suruurism@gmail.com Signed-off-by: Alex Williamson --- drivers/vfio/platform/vfio_platform_common.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c index c72db5a99ebd..ab531318f170 100644 --- a/drivers/vfio/platform/vfio_platform_common.c +++ b/drivers/vfio/platform/vfio_platform_common.c @@ -591,9 +591,13 @@ int vfio_platform_mmap(struct vfio_device *core_vdev, struct vm_area_struct *vma && (vma->vm_flags & VM_READ)) return -EINVAL; - if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE) - && (vma->vm_flags & VM_WRITE)) - return -EINVAL; + /* Prevent read-only region mappings from being upgraded with mprotect() */ + if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE)) { + if (vma->vm_flags & VM_WRITE) + return -EINVAL; + + vm_flags_clear(vma, VM_MAYWRITE); + } vma->vm_private_data = vdev;