[PATCH] fpga: dfl: afu: prevent read-only port mappings from becoming writable

[PATCH] fpga: dfl: afu: prevent read-only port mappings from becoming writable

[Abdifatah Suruur]

afu_mmap() rejects writable mappings of port regions without the WRITE
flag, but leaves VM_MAYWRITE set.  Userspace can map such a region
read-only and then upgrade the mapping to writable with mprotect(),
writing to FPGA port control/status registers the host owns.  A guest
assigned an AFU can use this to reconfigure or reset the port and
interfere with other tenants on the same FPGA.

Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for
its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and
drm/panthor (CVE-2024-53071) and ptp: vmclock (commit
a5edadbae57e2298a56cf7a4e774a027905a331f).

Fixes: 1a1527cf5ddac ("fpga: dfl: add FPGA Accelerated Function Unit driver basic framework")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>

---
--- a/drivers/fpga/dfl-afu-main.c
+++ b/drivers/fpga/dfl-afu-main.c
@@ -836,7 +836,11 @@
 	if ((vma->vm_flags & VM_WRITE) &&
 	    !(region.flags & DFL_PORT_REGION_WRITE))
 		return -EPERM;

+	/* Prevent read-only port mappings from being upgraded with mprotect() */
+	if (!(region.flags & DFL_PORT_REGION_WRITE))
+		vm_flags_clear(vma, VM_MAYWRITE);
+
 	/* Support debug access to the mapping */
 	vma->vm_ops = &afu_vma_ops;

 	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);

[PATCH] fpga: dfl: afu: prevent read-only port mappings from becoming writable

[Abdifatah Suruur]

afu_mmap() rejects writable mappings of port regions without the WRITE
flag, but leaves VM_MAYWRITE set.  Userspace can map such a region
read-only and then upgrade the mapping to writable with mprotect(),
writing to FPGA port control/status registers the host owns.  A guest
assigned an AFU can use this to reconfigure or reset the port and
interfere with other tenants on the same FPGA.

Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for
its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and
drm/panthor (CVE-2024-53071) and ptp: vmclock (commit
a5edadbae57e2298a56cf7a4e774a027905a331f).

Fixes: 1a1527cf5ddac ("fpga: dfl: add FPGA Accelerated Function Unit driver basic framework")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>

---
--- a/drivers/fpga/dfl-afu-main.c
+++ b/drivers/fpga/dfl-afu-main.c
@@ -836,7 +836,11 @@
 	if ((vma->vm_flags & VM_WRITE) &&
 	    !(region.flags & DFL_PORT_REGION_WRITE))
 		return -EPERM;

+	/* Prevent read-only port mappings from being upgraded with mprotect() */
+	if (!(region.flags & DFL_PORT_REGION_WRITE))
+		vm_flags_clear(vma, VM_MAYWRITE);
+
 	/* Support debug access to the mapping */
 	vma->vm_ops = &afu_vma_ops;

 	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);

Re: [PATCH] fpga: dfl: afu: prevent read-only port mappings from becoming writable

[Dinh Nguyen]

On 8/19/26 03:42, Abdifatah Suruur wrote:
> afu_mmap() rejects writable mappings of port regions without the WRITE
> flag, but leaves VM_MAYWRITE set.  Userspace can map such a region
> read-only and then upgrade the mapping to writable with mprotect(),
> writing to FPGA port control/status registers the host owns.  A guest
> assigned an AFU can use this to reconfigure or reset the port and
> interfere with other tenants on the same FPGA.
> 
> Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for
> its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and
> drm/panthor (CVE-2024-53071) and ptp: vmclock (commit
> a5edadbae57e2298a56cf7a4e774a027905a331f).
> 
> Fixes: 1a1527cf5ddac ("fpga: dfl: add FPGA Accelerated Function Unit driver basic framework")

Please used exactly 12 characters for the hash ID.

Dinh