* [PATCH] vfio/fsl-mc: prevent read-only region mappings from becoming writable
@ 2026-08-19 8:39 Abdifatah Suruur
0 siblings, 0 replies; 2+ messages in thread
From: Abdifatah Suruur @ 2026-08-19 8:39 UTC (permalink / raw)
To: kvm; +Cc: linux-kernel, alex.williamson
vfio_fsl_mc_mmap() rejects writable mappings of regions without the
WRITE flag, but leaves VM_MAYWRITE set. Userspace can map such a region
read-only and then upgrade the mapping to writable with mprotect(),
writing to MMIO regions (e.g. response portals) the device marks
read-only.
Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for
its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and
drm/panthor (CVE-2024-53071) and ptp: vmclock (commit
a5edadbae57e2298a56cf7a4e774a027905a331f).
Fixes: fb1ff4c194157 ("vfio/fsl-mc: Add VFIO framework skeleton for fsl-mc devices")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
---
--- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c
+++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c
@@ -406,7 +406,11 @@
if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE)
&& (vma->vm_flags & VM_WRITE))
return -EINVAL;
+ /* Prevent read-only region mappings from being upgraded with mprotect() */
+ if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE))
+ vm_flags_clear(vma, VM_MAYWRITE);
+
vma->vm_private_data = mc_dev;
return vfio_fsl_mc_mmap_mmio(vdev->regions[index], vma);
}
^ permalink raw reply [flat|nested] 2+ messages in thread* [PATCH] vfio/fsl-mc: prevent read-only region mappings from becoming writable
@ 2026-08-19 8:42 Abdifatah Suruur
0 siblings, 0 replies; 2+ messages in thread
From: Abdifatah Suruur @ 2026-08-19 8:42 UTC (permalink / raw)
To: kvm; +Cc: linux-kernel, alex.williamson
vfio_fsl_mc_mmap() rejects writable mappings of regions without the
WRITE flag, but leaves VM_MAYWRITE set. Userspace can map such a region
read-only and then upgrade the mapping to writable with mprotect(),
writing to MMIO regions (e.g. response portals) the device marks
read-only.
Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for
its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and
drm/panthor (CVE-2024-53071) and ptp: vmclock (commit
a5edadbae57e2298a56cf7a4e774a027905a331f).
Fixes: fb1ff4c194157 ("vfio/fsl-mc: Add VFIO framework skeleton for fsl-mc devices")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
---
--- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c
+++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c
@@ -406,7 +406,11 @@
if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE)
&& (vma->vm_flags & VM_WRITE))
return -EINVAL;
+ /* Prevent read-only region mappings from being upgraded with mprotect() */
+ if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE))
+ vm_flags_clear(vma, VM_MAYWRITE);
+
vma->vm_private_data = mc_dev;
return vfio_fsl_mc_mmap_mmio(vdev->regions[index], vma);
}
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-19 8:42 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-19 8:39 [PATCH] vfio/fsl-mc: prevent read-only region mappings from becoming writable Abdifatah Suruur
-- strict thread matches above, loose matches on Subject: below --
2026-08-19 8:42 Abdifatah Suruur
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).