From 9c5cd385d295fa8621dff0e9f6063e3f6ff24159 Mon Sep 17 00:00:00 2001 From: Abdifatah Suruur Date: Tue, 29 Sep 2026 12:48:44 +0300 Subject: [PATCH] vfio/cdx: prevent read-only region mappings from becoming writable vfio_cdx_mmap() rejects writable mappings of regions without the WRITE flag, but leaves VM_MAYWRITE set. Userspace can map such a region read-only and then upgrade the mapping to writable with mprotect(), writing to MMIO regions the device marks read-only. Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445), drm/panthor (CVE-2024-53071) and commit a5edadbae57e ("ptp: vmclock: prevent read-only mappings from becoming writable"). Note this is defensive hardening: no in-tree cdx device currently publishes a region without the WRITE flag. The guard costs nothing and keeps the mmap() interface honest if a read-only region ever appears. Fixes: 234489ac56130 ("vfio/cdx: add support for CDX bus") Signed-off-by: Abdifatah Suruur Link: https://lore.kernel.org/r/20260929094848.7439-4-suruurism@gmail.com Signed-off-by: Alex Williamson --- drivers/vfio/cdx/main.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/vfio/cdx/main.c b/drivers/vfio/cdx/main.c index b31ed4be7bdc..28386fdb01f2 100644 --- a/drivers/vfio/cdx/main.c +++ b/drivers/vfio/cdx/main.c @@ -281,9 +281,13 @@ static int vfio_cdx_mmap(struct vfio_device *core_vdev, (vma->vm_flags & VM_READ)) return -EPERM; - if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE) && - (vma->vm_flags & VM_WRITE)) - return -EPERM; + /* Prevent read-only region mappings from being upgraded with mprotect() */ + if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE)) { + if (vma->vm_flags & VM_WRITE) + return -EPERM; + + vm_flags_clear(vma, VM_MAYWRITE); + } return vfio_cdx_mmap_mmio(vdev->regions[index], vma); }