Re: [PATCH] ublk: clear VM_MAYWRITE on read-only ublk char device mmap

[Greg KH <gregkh@linuxfoundation.org>]

On Sun, Aug 30, 2026 at 12:31:33PM +0530, Kanishka De Silva wrote:
> ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never
> clears VM_MAYWRITE on the resulting read-only mapping. This allows
> a userspace daemon to mmap the per-queue command buffer PROT_READ,
> then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was
> never cleared.
> 
> The command buffer holds struct ublksrv_io_desc entries that are
> kernel-written ABI; a writable mapping lets an unprivileged daemon
> process corrupt fields such as addr, op_flags, nr_sectors, and
> start_sector.
> 
> Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and
> the 2026-08-13 ptp/vmclock fix (a5edadbae57e).
> 
> Verified via mprotect() PoC: before the fix, a PROT_READ mapping can
> be upgraded to PROT_READ|PROT_WRITE and a write into the command
> buffer corrupts io_desc fields (confirmed under KASAN). After the
> fix, mprotect() returns -EACCES.
> 
> Fixes: 3fee8d7599e1 ("ublk_drv: add io_uring based userspace block driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kanishka De Silva <kpskanna1915@gmail.com>
> ---
>  drivers/block/ublk_drv.c | 6 ++++++
>  1 file changed, 6 insertions(+)

You only sent this to the stable list in public, and didn't cc: any of
the relevant maintainers or the proper mailing list.  Please use
scripts/get_maintainer.pl on your patch to determine who to send stuff
to.

thanks,

greg k-h