[PATCH] vfio/platform: prevent read-only region mappings from becoming writable
Abdifatah Suruur <[email protected]>
| Newsgroups | org.kernel.vger.kvm,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
vfio_platform_mmap() rejects writable mappings of regions without the
WRITE flag, but leaves VM_MAYWRITE set. Userspace can map such a region
read-only and then upgrade the mapping to writable with mprotect(),
writing to MMIO regions the platform marks read-only.
Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for
its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and
drm/panthor (CVE-2024-53071) and ptp: vmclock (commit
a5edadbae57e2298a56cf7a4e774a027905a331f).
Fixes: de49fc0d99e6a ("vfio/platform: initial skeleton of VFIO support for platform devices")
Cc: [email protected]
Signed-off-by: Abdifatah Suruur <[email protected]>
---
--- a/drivers/vfio/platform/vfio_platform_common.c
+++ b/drivers/vfio/platform/vfio_platform_common.c
@@ -594,7 +594,11 @@
if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE)
&& (vma->vm_flags & VM_WRITE))
return -EINVAL;
+ /* Prevent read-only region mappings from being upgraded with mprotect() */
+ if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE))
+ vm_flags_clear(vma, VM_MAYWRITE);
+
vma->vm_private_data = vdev;
if (vdev->regions[index].type & VFIO_PLATFORM_REGION_TYPE_MMIO)
return vfio_platform_mmap_mmio(vdev->regions[index], vma);