[PATCH] fpga: dfl: afu: prevent read-only port mappings from becoming writable
Abdifatah Suruur <[email protected]>
| Newsgroups | org.kernel.vger.linux-fpga,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
afu_mmap() rejects writable mappings of port regions without the WRITE
flag, but leaves VM_MAYWRITE set. Userspace can map such a region
read-only and then upgrade the mapping to writable with mprotect(),
writing to FPGA port control/status registers the host owns. A guest
assigned an AFU can use this to reconfigure or reset the port and
interfere with other tenants on the same FPGA.
Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for
its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and
drm/panthor (CVE-2024-53071) and ptp: vmclock (commit
a5edadbae57e2298a56cf7a4e774a027905a331f).
Fixes: 1a1527cf5ddac ("fpga: dfl: add FPGA Accelerated Function Unit driver basic framework")
Cc: [email protected]
Signed-off-by: Abdifatah Suruur <[email protected]>
---
--- a/drivers/fpga/dfl-afu-main.c
+++ b/drivers/fpga/dfl-afu-main.c
@@ -836,7 +836,11 @@
if ((vma->vm_flags & VM_WRITE) &&
!(region.flags & DFL_PORT_REGION_WRITE))
return -EPERM;
+ /* Prevent read-only port mappings from being upgraded with mprotect() */
+ if (!(region.flags & DFL_PORT_REGION_WRITE))
+ vm_flags_clear(vma, VM_MAYWRITE);
+
/* Support debug access to the mapping */
vma->vm_ops = &afu_vma_ops;
vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);