* Re: [PATCH] ublk: clear VM_MAYWRITE on read-only ublk char device mmap
2026-08-30 7:01 ` [PATCH] ublk: clear VM_MAYWRITE on read-only ublk char device mmap Kanishka De Silva
@ 2026-08-30 7:21 ` Ming Lei
2026-08-30 7:23 ` Greg KH
2026-09-01 14:44 ` Jens Axboe
2 siblings, 0 replies; 5+ messages in thread
From: Ming Lei @ 2026-08-30 7:21 UTC (permalink / raw)
To: Kanishka De Silva; +Cc: greg, security, stable, Jens Axboe
On Sun, Aug 30, 2026 at 2:01 AM Kanishka De Silva
<kpskanna1915@gmail.com> wrote:
>
> ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never
> clears VM_MAYWRITE on the resulting read-only mapping. This allows
> a userspace daemon to mmap the per-queue command buffer PROT_READ,
> then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was
> never cleared.
>
> The command buffer holds struct ublksrv_io_desc entries that are
> kernel-written ABI; a writable mapping lets an unprivileged daemon
> process corrupt fields such as addr, op_flags, nr_sectors, and
> start_sector.
>
> Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and
> the 2026-08-13 ptp/vmclock fix (a5edadbae57e).
>
> Verified via mprotect() PoC: before the fix, a PROT_READ mapping can
> be upgraded to PROT_READ|PROT_WRITE and a write into the command
> buffer corrupts io_desc fields (confirmed under KASAN). After the
> fix, mprotect() returns -EACCES.
>
> Fixes: 3fee8d7599e1 ("ublk_drv: add io_uring based userspace block driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kanishka De Silva <kpskanna1915@gmail.com>
> ---
> drivers/block/ublk_drv.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
> index 6c5bec7..e5ba07d 100644
> --- a/drivers/block/ublk_drv.c
> +++ b/drivers/block/ublk_drv.c
> @@ -2653,6 +2653,12 @@ static int ublk_ch_mmap(struct file *filp, struct vm_area_struct *vma)
> if (vma->vm_flags & VM_WRITE)
> return -EPERM;
>
> + /*
> + * The per-queue command buffer is kernel-written ABI; prevent
> + * the daemon from upgrading to writable via mprotect().
> + */
> + vm_flags_clear(vma, VM_MAYWRITE);
> +
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
Thanks,
Ming Lei
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] ublk: clear VM_MAYWRITE on read-only ublk char device mmap
2026-08-30 7:01 ` [PATCH] ublk: clear VM_MAYWRITE on read-only ublk char device mmap Kanishka De Silva
2026-08-30 7:21 ` Ming Lei
@ 2026-08-30 7:23 ` Greg KH
2026-09-01 14:44 ` Jens Axboe
2 siblings, 0 replies; 5+ messages in thread
From: Greg KH @ 2026-08-30 7:23 UTC (permalink / raw)
To: Kanishka De Silva; +Cc: tom.leiming, security, stable
On Sun, Aug 30, 2026 at 12:31:33PM +0530, Kanishka De Silva wrote:
> ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never
> clears VM_MAYWRITE on the resulting read-only mapping. This allows
> a userspace daemon to mmap the per-queue command buffer PROT_READ,
> then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was
> never cleared.
>
> The command buffer holds struct ublksrv_io_desc entries that are
> kernel-written ABI; a writable mapping lets an unprivileged daemon
> process corrupt fields such as addr, op_flags, nr_sectors, and
> start_sector.
>
> Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and
> the 2026-08-13 ptp/vmclock fix (a5edadbae57e).
>
> Verified via mprotect() PoC: before the fix, a PROT_READ mapping can
> be upgraded to PROT_READ|PROT_WRITE and a write into the command
> buffer corrupts io_desc fields (confirmed under KASAN). After the
> fix, mprotect() returns -EACCES.
>
> Fixes: 3fee8d7599e1 ("ublk_drv: add io_uring based userspace block driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kanishka De Silva <kpskanna1915@gmail.com>
> ---
> drivers/block/ublk_drv.c | 6 ++++++
> 1 file changed, 6 insertions(+)
You only sent this to the stable list in public, and didn't cc: any of
the relevant maintainers or the proper mailing list. Please use
scripts/get_maintainer.pl on your patch to determine who to send stuff
to.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] ublk: clear VM_MAYWRITE on read-only ublk char device mmap
2026-08-30 7:01 ` [PATCH] ublk: clear VM_MAYWRITE on read-only ublk char device mmap Kanishka De Silva
2026-08-30 7:21 ` Ming Lei
2026-08-30 7:23 ` Greg KH
@ 2026-09-01 14:44 ` Jens Axboe
2 siblings, 0 replies; 5+ messages in thread
From: Jens Axboe @ 2026-09-01 14:44 UTC (permalink / raw)
To: greg, Kanishka De Silva; +Cc: tom.leiming, security, stable
On Sun, 30 Aug 2026 12:31:33 +0530, Kanishka De Silva wrote:
> ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never
> clears VM_MAYWRITE on the resulting read-only mapping. This allows
> a userspace daemon to mmap the per-queue command buffer PROT_READ,
> then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was
> never cleared.
>
> The command buffer holds struct ublksrv_io_desc entries that are
> kernel-written ABI; a writable mapping lets an unprivileged daemon
> process corrupt fields such as addr, op_flags, nr_sectors, and
> start_sector.
>
> [...]
Applied, thanks!
[1/1] ublk: clear VM_MAYWRITE on read-only ublk char device mmap
commit: 6e2b571b0a54755b06e092501913e1dfefe75d6c
Best regards,
--
Jens Axboe
^ permalink raw reply [flat|nested] 5+ messages in thread