From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A205E30B51F for ; Thu, 17 Sep 2026 21:10:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789679410; cv=none; b=jfpiyTudjLtn2eOMI4Pe+evVWhSRs4EzbygD3+o2KLfK0c1tdqlyhbYZKUT83CbyaBIcRLsEMSCCThOneZopLEooAoVtXmEk7W+LMWezqHFQc6dW4Ox/kQBNSLj9KgSJfz8m0725Q6Ls2Iq92vY5b0P5nCHaHAxrNyeY94jXH5Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789679410; c=relaxed/simple; bh=4gyRjmEG1XstD6IgSAMRs57mP6xQsJmByoPhhLIbKfI=; h=Date:To:From:Subject:Message-Id; b=PAz22KnWQEiMs2x3iBOzaQ6icWr3jeaROO3kkO4aXIbaDVQ8Ss6JllMuDFUybwM0coA9ZP7yXRWpQsZw7epwNKiHVms7uIHCvVDh/nCXE4AdKr5j6d7HPzeFJbAbc22DMDtlWJ3lK03tFtUbyRR/395APhzk1ZCthvepppb0euk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=BRoc4hBk; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="BRoc4hBk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7992F1F00893; Thu, 17 Sep 2026 21:10:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1789679409; bh=cotCdIlms5/NL3m5u47YCOvxY3QT6Fqbe5QmVXRboRQ=; h=Date:To:From:Subject; b=BRoc4hBkJ0jkv/j22nRjrfmLFtlN55TutDMaiAKiOVQDRwwq+SHmoTSsHN0RBWozb Ruq8k+/eSpFN/hwkmmkWMzg4baqM2IGhUdg6qzy7meTawJBL0+Z0eJu660y+4w77QY rRnANEv2RUi4Atk83vti5F+Z8bXutvwQsxpeFobg= Date: Thu, 17 Sep 2026 14:10:09 -0700 To: mm-commits@vger.kernel.org,ljs@kernel.org,akpm@linux-foundation.org From: Andrew Morton Subject: [to-be-updated] mm-vma-only-allow-mmap-to-clear-vma_maywrite_bit-if-kernel-owned.patch removed from -mm tree Message-Id: <20260917211009.7992F1F00893@smtp.kernel.org> Precedence: bulk X-Mailing-List: mm-commits@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: The quilt patch titled Subject: mm/vma: only allow mmap to clear VMA_MAYWRITE_BIT if kernel-owned has been removed from the -mm tree. Its filename was mm-vma-only-allow-mmap-to-clear-vma_maywrite_bit-if-kernel-owned.patch This patch was dropped because an updated version will be issued ------------------------------------------------------ From: "Lorenzo Stoakes (ARM)" Subject: mm/vma: only allow mmap to clear VMA_MAYWRITE_BIT if kernel-owned Date: Mon, 14 Sep 2026 15:57:36 +0100 For ordinary files the only way the VMA_MAYWRITE_BIT flag is cleared is if the underlying file is itself read-only. This means that mprotect() cannot mark a shared mapping of a read-only file as read/write, as doing so would violate the read only attribute, and permit writes. In general, we do not want file systems to be able to do this for read/write files. Doing so would violate fundamental user expectation of file attributes and likely break userspace. However, drivers pose a tricky problem here - the /dev/xxx file may be read/write but provide access to a resource which is fundamentally read-only. Therefore we must allow drivers to be able to clear VMA_MAYWRITE_BIT. To achieve both of these things, restrict this ability to kernel-owned mappings as identified by vma_flags_is_kernel_owned(). This constrains this ability to drivers which own the mapping's contents, whether memory-mapped I/O, kernel-allocated pages, or ordinary pages they map themselves, and so define its semantics. Every in-tree mmap hook which clears VMA_MAYWRITE_BIT, some twenty sites across drivers, filesystems and bpf, establishes a kernel-owned mapping, with usbmon and the ALSA PCM status page converted earlier in this series to do so. Note that drivers may, if they do not gate on VMA_SHARED_BIT, be able to disable MAP_PRIVATE-file-backed mapping CoW semantics. This is perhaps not always intended, but we retain this capacity to maintain existing behaviour. As all drivers which clear VMA_MAYWRITE_BIT establish kernel-owned mappings, no functional change is intended. Link: https://lore.kernel.org/20260914-b4-mmap-prepare-vma-flag-sanify-v2-16-7d9781ed5361@kernel.org Signed-off-by: Lorenzo Stoakes (ARM) Signed-off-by: Andrew Morton --- mm/vma.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/mm/vma.c~mm-vma-only-allow-mmap-to-clear-vma_maywrite_bit-if-kernel-owned +++ a/mm/vma.c @@ -2795,6 +2795,11 @@ static int mmap_validate(unsigned long p if (WARN_ON_ONCE(!was_maywrite && is_maywrite)) return -EINVAL; + /* Only kernel-owned mappings may clear VMA_MAYWRITE_BIT. */ + if (!vma_flags_is_kernel_owned(curr_flags) && + WARN_ON_ONCE(was_maywrite && !is_maywrite)) + return -EINVAL; + return mmap_validate_vma_flags(curr_flags); } _ Patches currently in -mm which might be from ljs@kernel.org are mm-vmpressure-remove-window-size-todo.patch tools-testing-selftests-mm-add-missing-gitignore-entries.patch mm-move-drivers-char-memc-to-mm-char-memc.patch mm-implement-file_is_dev_zero-to-uniquely-identify-dev-zero.patch mm-vma-only-permit-map_private-dev-zero-to-be-mapped-anonymous.patch mm-vma-make-map_private-mapped-dev-zero-mappings-truly-anonymous.patch tools-testing-vma-add-test-to-assert-map_private-dev-zero-is-anon.patch tools-testing-selftests-mm-add-map_private-dev-zero-merge-tests.patch mm-madvise-swap-in-cowd-map_private-file-mappings-on-madv_willneed.patch mm-huge_memory-zap-deposited-page-tables-after-an-rcu-grace-period.patch mm-enable-mmu_gather_rcu_table_free-for-most-2-level-architectures.patch mm-enable-mmu_gather_rcu_table_free-for-mmu-riscv.patch mm-enable-mmu_gather_rcu_table_free-for-mmu-arm.patch mm-enable-mmu_gather_rcu_table_free-for-arc-microblaze-xtensa.patch mm-enable-mmu_gather_rcu_table_free-for-sparc64.patch mm-enable-mmu_gather_rcu_table_free-for-m68k-coldfire.patch mm-enable-mmu_gather_rcu_table_free-for-sh-x2.patch mm-enable-mmu_gather_rcu_table_free-for-m68k-motorola.patch mm-enable-mmu_gather_rcu_table_free-for-sparc32.patch mm-make-userland-page-table-freeing-rcu-safe.patch mm-change-the-contract-for-free_pgtables-update-docs.patch mm-vma-add-and-use-vma__is_fixed_mapping.patch scsi-sg-convert-mmap-hook-to-mmap_prepare-and-rework.patch fbdev-defio-assert-fbinfo_virtfb-drop-vm_io-add-vm_mixedmap.patch hsi-cmt_speech-convert-mmap-hook-to-mmap_prepare-refactor.patch mm-gup-error-out-early-on-vma_mayread_bit-vmas.patch uprobes-remove-vm_io-set-vm_mixedmap-for-mapped-kernel-pages.patch mm-mlock-clear-vma_locked_mask-over-mmap-callback.patch mm-mlock-eliminate-weird-vma_io_bit-abuse-and-simplify.patch mm-vma-enforce-that-only-kernel-owned-mappings-may-set-vma_io_bit.patch mm-remove-vma_io_bit-check-in-vma_is_kernel_owned.patch mm-remove-hugetlb_inlineh.patch mm-rename-is_vm_hugetlb_page-to-vma_is_hugetlb.patch mm-drop-some-redundant-checks-around-hugetlb-vmas.patch mm-madvise-update-is_valid_guard_vma-to-use-vma_can_merge.patch mm-vma-introduce-vma_is_persistent.patch mm-uffd-use-predicates-for-userfaultfd-checks.patch mm-madvise-use-predicates-for-madvise-madv_dofork.patch mm-eliminate-vma_special_flags-usage-when-hugetlb-explicitly-tested.patch mm-eliminate-vma_special_flags-check-in-lru_gen_look_around.patch mm-avoid-use-of-vma_special_flags-in-migrate_vma_setup.patch mm-eliminate-vm_special-vma_special_flags.patch fuse-dax-do-not-set-vm_mixedmap.patch mm-huge_memory-remove-vma_is_special_huge.patch mm-vma-introduce-and-use-vma_can_gup.patch mm-vma-const-ify-vma_assert_stabilised-and-associated-functions.patch mm-implement-and-use-vma_has_anon_rmap-silence-kcsan.patch mm-update-comments-to-refer-to-anon-rmap-rather-than-anon_vma.patch