[PATCH] ublk: clear VM_MAYWRITE on read-only ublk char device mmap

[PATCH] ublk: clear VM_MAYWRITE on read-only ublk char device mmap

[Kanishka De Silva]

ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never
clears VM_MAYWRITE on the resulting read-only mapping. This allows
a userspace daemon to mmap the per-queue command buffer PROT_READ,
then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was
never cleared.

The command buffer holds struct ublksrv_io_desc entries that are
kernel-written ABI; a writable mapping lets an unprivileged daemon
process corrupt fields such as addr, op_flags, nr_sectors, and
start_sector.

Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and
the 2026-08-13 ptp/vmclock fix (a5edadbae57e).

Verified via mprotect() PoC: before the fix, a PROT_READ mapping can
be upgraded to PROT_READ|PROT_WRITE and a write into the command
buffer corrupts io_desc fields (confirmed under KASAN). After the
fix, mprotect() returns -EACCES.

Fixes: 3fee8d7599e1 ("ublk_drv: add io_uring based userspace block driver")
Cc: stable@vger.kernel.org
Signed-off-by: Kanishka De Silva <kpskanna1915@gmail.com>
---
 drivers/block/ublk_drv.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 6c5bec7..e5ba07d 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -2653,6 +2653,12 @@ static int ublk_ch_mmap(struct file *filp, struct vm_area_struct *vma)
 	if (vma->vm_flags & VM_WRITE)
 		return -EPERM;
 
+	/*
+	 * The per-queue command buffer is kernel-written ABI; prevent
+	 * the daemon from upgrading to writable via mprotect().
+	 */
+	vm_flags_clear(vma, VM_MAYWRITE);
+
 	end = UBLKSRV_CMD_BUF_OFFSET + ub->dev_info.nr_hw_queues * max_sz;
 	if (phys_off < UBLKSRV_CMD_BUF_OFFSET || phys_off >= end)
 		return -EINVAL;
-- 
2.53.0

Re: [PATCH] ublk: clear VM_MAYWRITE on read-only ublk char device mmap

[Ming Lei]

On Sun, Aug 30, 2026 at 2:01 AM Kanishka De Silva
<kpskanna1915@gmail.com> wrote:
>
> ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never
> clears VM_MAYWRITE on the resulting read-only mapping. This allows
> a userspace daemon to mmap the per-queue command buffer PROT_READ,
> then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was
> never cleared.
>
> The command buffer holds struct ublksrv_io_desc entries that are
> kernel-written ABI; a writable mapping lets an unprivileged daemon
> process corrupt fields such as addr, op_flags, nr_sectors, and
> start_sector.
>
> Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and
> the 2026-08-13 ptp/vmclock fix (a5edadbae57e).
>
> Verified via mprotect() PoC: before the fix, a PROT_READ mapping can
> be upgraded to PROT_READ|PROT_WRITE and a write into the command
> buffer corrupts io_desc fields (confirmed under KASAN). After the
> fix, mprotect() returns -EACCES.
>
> Fixes: 3fee8d7599e1 ("ublk_drv: add io_uring based userspace block driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kanishka De Silva <kpskanna1915@gmail.com>
> ---
>  drivers/block/ublk_drv.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
> index 6c5bec7..e5ba07d 100644
> --- a/drivers/block/ublk_drv.c
> +++ b/drivers/block/ublk_drv.c
> @@ -2653,6 +2653,12 @@ static int ublk_ch_mmap(struct file *filp, struct vm_area_struct *vma)
>         if (vma->vm_flags & VM_WRITE)
>                 return -EPERM;
>
> +       /*
> +        * The per-queue command buffer is kernel-written ABI; prevent
> +        * the daemon from upgrading to writable via mprotect().
> +        */
> +       vm_flags_clear(vma, VM_MAYWRITE);
> +

Reviewed-by: Ming Lei <tom.leiming@gmail.com>


Thanks,
Ming Lei

Re: [PATCH] ublk: clear VM_MAYWRITE on read-only ublk char device mmap

[Greg KH]

On Sun, Aug 30, 2026 at 12:31:33PM +0530, Kanishka De Silva wrote:
> ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never
> clears VM_MAYWRITE on the resulting read-only mapping. This allows
> a userspace daemon to mmap the per-queue command buffer PROT_READ,
> then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was
> never cleared.
> 
> The command buffer holds struct ublksrv_io_desc entries that are
> kernel-written ABI; a writable mapping lets an unprivileged daemon
> process corrupt fields such as addr, op_flags, nr_sectors, and
> start_sector.
> 
> Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and
> the 2026-08-13 ptp/vmclock fix (a5edadbae57e).
> 
> Verified via mprotect() PoC: before the fix, a PROT_READ mapping can
> be upgraded to PROT_READ|PROT_WRITE and a write into the command
> buffer corrupts io_desc fields (confirmed under KASAN). After the
> fix, mprotect() returns -EACCES.
> 
> Fixes: 3fee8d7599e1 ("ublk_drv: add io_uring based userspace block driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kanishka De Silva <kpskanna1915@gmail.com>
> ---
>  drivers/block/ublk_drv.c | 6 ++++++
>  1 file changed, 6 insertions(+)

You only sent this to the stable list in public, and didn't cc: any of
the relevant maintainers or the proper mailing list.  Please use
scripts/get_maintainer.pl on your patch to determine who to send stuff
to.

thanks,

greg k-h

[PATCH v2] ublk: clear VM_MAYWRITE on read-only ublk char device mmap

[Kanishka De Silva]

ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never
clears VM_MAYWRITE on the resulting read-only mapping. This allows
a userspace daemon to mmap the per-queue command buffer PROT_READ,
then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was
never cleared.

The command buffer holds struct ublksrv_io_desc entries that are
kernel-written ABI; a writable mapping lets an unprivileged daemon
process corrupt fields such as addr, op_flags, nr_sectors, and
start_sector.

Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and
the 2026-08-13 ptp/vmclock fix (a5edadbae57e).

Verified via mprotect() PoC: before the fix, a PROT_READ mapping can
be upgraded to PROT_READ|PROT_WRITE and a write into the command
buffer corrupts io_desc fields (confirmed under KASAN). After the
fix, mprotect() returns -EACCES.

Fixes: 3fee8d7599e1 ("ublk_drv: add io_uring based userspace block driver")
Cc: stable@vger.kernel.org
Signed-off-by: Kanishka De Silva <kpskanna1915@gmail.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
---
v2: Cc linux-block@vger.kernel.org and Jens Axboe per get_maintainer.pl
    (Greg KH). Added Reviewed-by from Ming Lei. No code change.

 drivers/block/ublk_drv.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 6c5bec7..e5ba07d 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -2653,6 +2653,12 @@ static int ublk_ch_mmap(struct file *filp, struct vm_area_struct *vma)
 	if (vma->vm_flags & VM_WRITE)
 		return -EPERM;
 
+	/*
+	 * The per-queue command buffer is kernel-written ABI; prevent
+	 * the daemon from upgrading to writable via mprotect().
+	 */
+	vm_flags_clear(vma, VM_MAYWRITE);
+
 	end = UBLKSRV_CMD_BUF_OFFSET + ub->dev_info.nr_hw_queues * max_sz;
 	if (phys_off < UBLKSRV_CMD_BUF_OFFSET || phys_off >= end)
 		return -EINVAL;
-- 
2.53.0

Re: [PATCH] ublk: clear VM_MAYWRITE on read-only ublk char device mmap

[Jens Axboe]

On Sun, 30 Aug 2026 12:31:33 +0530, Kanishka De Silva wrote:
> ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never
> clears VM_MAYWRITE on the resulting read-only mapping. This allows
> a userspace daemon to mmap the per-queue command buffer PROT_READ,
> then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was
> never cleared.
> 
> The command buffer holds struct ublksrv_io_desc entries that are
> kernel-written ABI; a writable mapping lets an unprivileged daemon
> process corrupt fields such as addr, op_flags, nr_sectors, and
> start_sector.
> 
> [...]

Applied, thanks!

[1/1] ublk: clear VM_MAYWRITE on read-only ublk char device mmap
      commit: 6e2b571b0a54755b06e092501913e1dfefe75d6c

Best regards,
-- 
Jens Axboe