Re: [PATCH v2 0/7] vfio: mmap()/mprotect() hygiene for MMIO region mappings

[Alex Williamson <alex@shazbot.org>]

On Tue, 27 Oct 2026 04:22:04 -0700 (PDT)
Abdifatah Suruur <suruurism@gmail.com> wrote:

> Hi Alex,
> 
> Thanks again for applying the vfio mmap()/mprotect() series for 7.4. I
> have one process question about stable backports.
> 
> Patches 1-3 (vfio/platform, vfio/fsl-mc, vfio/cdx: prevent read-only
> region mappings from becoming writable) still carry their Fixes tags.
> They are the same VM_MAYWRITE/mprotect class as CVE-2026-68445
> (drm/vc4) and CVE-2026-80724 (ptp/vmclock), and I am tracking the class
> as a security fix. Would you like those three to carry
> Cc: stable@vger.kernel.org so they can be backported once they reach
> mainline, or do you prefer to keep the whole series 7.4-only?
> 
> I understand patches 4-7 were deliberately framed as hygiene (Fixes tags
> dropped) and I am not asking for those to be marked stable. I am just
> clarifying the intent for 1-3 so I follow the right process.
> 
> If you prefer 7.4-only, no change to the applied patches is needed.

The commits are immutable now.  They can be proposed to stable, but they
cannot be amended to include a tag for stable.  Personally, I think the
backport argument for any of these is weak, thus the framing as hygiene
and hardening.  IIRC, none of them have any exploit path and largely
guard against future work exposing these vulnerabilities.  That
theoretical future work would largely be feature rather than fix
oriented, so the demand for stable seems low to me.  Thanks,

Alex