From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f45.google.com (mail-wr1-f45.google.com [209.85.221.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 140D63AD52A for ; Thu, 13 Aug 2026 17:47:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786643240; cv=none; b=NBo2pcQLTgq1zpPOIQgP/gAXOcIEDW17hu3QjDi2erg7as58xJNYzP6uAn9+p+7uWg5vq54cNBt+AiYKdlumpdZ/yzy+dxqFUco84FXuH9LyyFerumKG4EavcKawUQ8cj7GXUQYPmlS63BnlrRbLdktGkpJ3+cJB1pS8AH9WdLM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786643240; c=relaxed/simple; bh=pWbFVB6hMHQbmXekH9w26NBkSZWrnle2Say6dxS8m1k=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=OpjzlDeIEDETNBqp5UfsAQ8Li3o6IJ2kyEOAjF6cVJJvSHwDXgQeSmnutk6Se901odfJI1MIfND0jdhY6wyVsBskYIO11t3LWHCYED5Te36o4OGcluHssLbpIEoYTWn2T6R13PY9DpgDBD0BMsvMZFcHA6oA+lrHACA+WdfH1aA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=nW1zBEJi; arc=none smtp.client-ip=209.85.221.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="nW1zBEJi" Received: by mail-wr1-f45.google.com with SMTP id ffacd0b85a97d-47f84023916so79826f8f.3 for ; Thu, 13 Aug 2026 10:47:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786643236; x=1787248036; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=VnWj3Ci1OnIACJ3JVJqb73bM1HVRpMarLwyVRWGih30=; b=nW1zBEJiLkjMlNvu6fnR6jCOJKdRSj46AkRsBok6qZqrSzwNmG6EzviX7y9Gm53NWd 8HK+yAhWxVbwm9CX3Cpq97oJtkdES0Efo29Rfq+e8gFg7tIRbVvXS2jtXIOoWKiwiG02 6dPUkGnRTLVzyHbOTik/LGYcEz7l/LvzkkL5o2Qzk7ZaVsrwumwxN+jF6JfEZisdbq7i PP1fLsppm5PQWpAjUjJIqfSmp9HruI1xwjPfQj5O3LlNNS3XenNbfpjULR/PKcDKftOI kPTT2HQbgqIRdlbqnwT0RrIuYzFXt4WY34IjwU3i88ls0g++7v1Xfr4WBMAvd4HpnHz+ yoPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786643236; x=1787248036; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=VnWj3Ci1OnIACJ3JVJqb73bM1HVRpMarLwyVRWGih30=; b=jf+dVvyGA91ZvKmkDdVbZ8qs7eboYt/fB6yX645L9FGpDt1s/Ak88cCR6yF4MY2V9Y YuoE/KQH7lX++hYo1iVR/HbmbENDfjL2Ry4c4BMC2J439T9HlQEMeLrYg4vpJocWXjld WAS9xN2VsQpgl+n/7CieADCZVVPk87Z4lLd60LxQrbDH8hufcFP3CU9qs0/GwZjoIw/v zbcvwHdVXPwdrAX1LztSRqvkH/Llrk3ZF8LRup1v34Z1xmMcBYTh58rKUxrswtY8xrVR XFXNrHgZ7/8GP19jdQAvXHm/5+NdzGGm95HMDZvyFsLk0pEuo6craEYswxDSaWBlIpq6 gynA== X-Gm-Message-State: AOJu0Yy9kO1QngGE6SiMX5bsVyCtTdbeLsqVbUK3mCm0pT0NisB/ivSD v6NPJoxl2bF5WhKKJDDnmhRZdyy9al8vxJlPTr4NZyFY9HYpnEqoGiej X-Gm-Gg: AR+sD12HFSZfRaAEuG2Kq7gyKpcmECZKvuLv4OPye8yQkexrMBZxIXiCLEJjMKPe1IO eWINd61HkasqbOQ+iMHSfnFKtxRCJ1xdopw7TeqWUV2rK/2JzrJYywUfdxF3xNRFZu4O9m4V7ed vblZPvAoxARoEkveyTJpxW4YUC3SHaF6IEH+wLLy+Y13uNwntSz+O2A/DIAzbhXviEPPGsQ7zue 4k7dcAwY4OR6X4LaeJHNoMil6Njlpio6S4Hg5heGQBI0z8IJTnG/xM6u0X6hV4sU+IZt5YCI2aC K+SpxZkL+Y8d/QE9mNsjnzrQLrM1mpi9FeTNbQT58BW+VvP3p3mLO1/wuwdALgoE3yN4Pb9iJT5 sTxnfkoIHKTVrKXWXfkaTt9WlPTm8Dygs1Mq1Vq6hrliXn07+05vBia5LK/L2/HQUJMIIsueXzb uFgT/T1oZkCKYB3FN/WqK+hAcXap4M1EBzL8mGgNQiUOWhZNgI2VwuVOahK+OxowGtYL3H X-Received: by 2002:adf:e193:0:b0:474:18d9:8371 with SMTP id ffacd0b85a97d-4815a011050mr11963406f8f.28.1786643235944; Thu, 13 Aug 2026 10:47:15 -0700 (PDT) Received: from SurHub.localdomain ([102.218.51.180]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4815f21a068sm986132f8f.12.2026.08.13.10.47.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Aug 2026 10:47:15 -0700 (PDT) From: Abdifatah Suruur To: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, dwmw2@infradead.org, Abdifatah Suruur Subject: [PATCH net] ptp: vmclock: prevent read-only mappings from becoming writable Date: Thu, 13 Aug 2026 20:47:07 +0300 Message-ID: <20260813174707.14809-1-suruurism@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only. Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071). Reported-by: Abdifatah Suruur Fixes: 2050327242269 ("ptp: Add support for the AMZNC10C vmclock device") Cc: stable@vger.kernel.org Signed-off-by: Abdifatah Suruur --- --- a/drivers/ptp/ptp_vmclock.c +++ b/drivers/ptp/ptp_vmclock.c @@ -372,6 +372,12 @@ if ((vma->vm_flags & (VM_READ|VM_WRITE)) != VM_READ) return -EROFS; + /* + * Restrict the read-only mapping so it cannot be upgraded to + * writable later with mprotect(). + */ + vm_flags_clear(vma, VM_MAYWRITE); + if (vma->vm_end - vma->vm_start != PAGE_SIZE || vma->vm_pgoff) return -EINVAL;