From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 57F25429CD0 for ; Wed, 19 Aug 2026 08:42:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787128946; cv=none; b=tT6wDPsnQIN46K6zhndBM12yR93NnqrC66ft1fnR5m59rorvSgzIJr0bp5GOa5QEE41uAHCbL9UiF8ymKE/9Cwmkv+dFPZv28oubC1fWkiRAHq+O/tLCxrUnq6tXInTdTiJsyt07+t9+Q0AVdo66uTWsaSBe0pXhHE5+2lGCbzs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787128946; c=relaxed/simple; bh=vklNabYPVRy3SCp8lBm14iKb9D2+4ZaFn8+UFYLemuE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=U/ekNgUIUCD6Mw4WarXvzwGXusZRgPkUZ346KvcfyhuUDcbSmazaCaCxjxV9ME00CBSEwvABYqTeobQfLJs73Wz65sf2GBBwTfXlbjZAHpQn2pLDYiR4lPQ1mGABC4gZ0zppg64PXIF7gJWkJ2UFnwpEJoWWvSyR6SGmmC79mHs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Hv4dkOpt; arc=none smtp.client-ip=209.85.128.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Hv4dkOpt" Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4953de5be0aso5822405e9.0 for ; Wed, 19 Aug 2026 01:42:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787128943; x=1787733743; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=hjjUvOmK0OPOz9lxQcUSjqU8S6ZDd+xG7uAE7UP0M10=; b=Hv4dkOpt4eOFMoiEV72A91ccp81k/YTb85ogadQXigUFZRjoartuJum/45A0Jf91lk G3Hv2jibN3v45PAkcKHuMoGZs8Ed18foIhn0jiSaBtZZYFbgAYYF5h28jWDdcYmx+ZNY fHarVpNFiVPb+ut704ITV3R9tRT7ywnkfFOdV/B2P1jWUQKk5LcCaM03SlCvOIRu01bo p2YZNvZE540MzHLqc3wEhHWHR0bG2GzhZDNZ5MZC+3WsorlD57zDDvZnSC5daOV7XDDK RsT4ILCnTvG/m86kZzXQElIqrhz4NV5K9VgTkXdlsuBa9DWV5MMe3/7isT/3h76WIrDP 3o6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787128943; x=1787733743; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=hjjUvOmK0OPOz9lxQcUSjqU8S6ZDd+xG7uAE7UP0M10=; b=kee3xn2Do5qNURrSNZoFqyQxSaqkHJc9cs+SuP4GMy37ZHYxTbIIj2xpajFQdhywZG KJHCXQNamcLcZip4zh+Y5FEK3XKW5WJdiZ/kEbRtkwldLiU7d2HDSTXrbuj6F/00vddx vWoJHoZ1LRMlPUg4pjsyxahjDU04gSOeOqAUKZQBEdO3qd5rvztgWeP1FIC+BKHIJ+BQ lH9U/BQ9aCEWgqSII8uraBfC5TezsNY1zxRhc2dTLUYAuUzdWV98JiEmJhdJHzpymlme YhhYzR1P3AUX9HfDqxH0tAhKMN4/TzRn4/XRe9qdveMLS81eaVcH5fgAS307UG317icB t4ww== X-Gm-Message-State: AOJu0YzQyvyEQB8TydYmcRpzV2Cdu3ETYfsbBDkiU0FoJjLK4uFmLacL ZM/z8PIZsgzA5E4lpd5/NODv2wRMI4peiQFWSQ+Sz6c0DWm6UA55PJU2LZ+Vug== X-Gm-Gg: AR+sD115dDL36HeUaRJMqq6GX/UC4x3xuVnHoYU68fesnv+mkz1jsMyuAgKByhWGvrW DHuyaJn8oOG4aj/psbr+22IOKywwN9vv5kKEFzROvMjTfs6/qSIkV6iZVPOItRZjzZEE0d+abm7 prd1EHF8HIf+Fah/j8q/3uFbYuVrtMfPLErM7qHSY+STJvgaPQt0PdCgGSijU3Z0RuDpsli7doS wP6Rw/tdazdAVyLTnxB5VZA/6KCnsHbQpaoQo5eVWg8eRp6EeFvmumZj/2i4Ro82jRxRa6YAo+R gBmL1GHO3wAfF1DDsXVRbVIOWdylVQVvvnhsmm1VmL5cbAS/QaRREsEfNzie49/kNiDqI7bdc9d CJ29IrCDmH7EPpxyIk0iIaJxpf+W//RRoj+RRfdnPpUlzPfFV+NHeTIlhiCeISlZxCMEjKMOrXx if4pegEW5aTXVRIrFzUpV3hR3CRUdXPd3JxKBNeeaP3hyJMQ6QqQm+Jth8XjWAUHWvdvIF X-Received: by 2002:a05:600c:a05:b0:495:3da3:beb with SMTP id 5b1f17b1804b1-499aa1b6a02mr45293395e9.10.1787128943217; Wed, 19 Aug 2026 01:42:23 -0700 (PDT) Received: from SurHub.localdomain ([196.188.112.82]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-499ab2a8b34sm48429415e9.8.2026.08.19.01.42.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 01:42:22 -0700 (PDT) From: Abdifatah Suruur To: xen-devel@lists.xenproject.org Cc: linux-kernel@vger.kernel.org, jgross@suse.com Subject: [PATCH] xen/gntdev: prevent private mappings from becoming writable Date: Wed, 19 Aug 2026 11:42:17 +0300 Message-ID: <20260819084217.1577-1-suruurism@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit gntdev_mmap() rejects writable private (non-shared) mappings of foreign grant pages, because a private writable mapping takes the COW path on pages that have no proper struct-page backing. However, VM_MAYWRITE is left set, so userspace can map the grant read-only and then upgrade the mapping to writable with mprotect(), hitting the same COW path the check was written to prevent. Clear VM_MAYWRITE for private mappings, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071) and ptp: vmclock (commit a5edadbae57e2298a56cf7a4e774a027905a331f). Fixes: ab31523c2fcac ("xen/gntdev: allow usermode to map granted pages") Cc: stable@vger.kernel.org Signed-off-by: Abdifatah Suruur --- diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c index 1dcc4675580ed..b71f5bae25b63 100644 --- a/drivers/xen/gntdev.c +++ b/drivers/xen/gntdev.c @@ -1066,6 +1066,13 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) if ((vma->vm_flags & VM_WRITE) && !(vma->vm_flags & VM_SHARED)) return -EINVAL; + /* + * Private mappings of foreign grant pages must never become + * writable: they would take the COW path on granted pages. + */ + if (!(vma->vm_flags & VM_SHARED)) + vm_flags_clear(vma, VM_MAYWRITE); + pr_debug("map %d+%d at %lx (pgoff %lx)\n", index, count, vma->vm_start, vma->vm_pgoff);