From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C8C3A42900D for ; Wed, 19 Aug 2026 08:40:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787128803; cv=none; b=ZXlj8Auxekins6QemtS0hgew0wwLlMa3IcZ+4iDC3IGotizAs4sTORZ9T4yclhAp2bKK7vOP/pCZz6EEAnNIVnBsKFAnsXPUlDZc7I69MIq1/pUFxbVWJrdZcFJ6suPoPcfsUt10FW1lcTbrdao8h7/pYTldx+QE2o1y8O2dJig= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787128803; c=relaxed/simple; bh=vklNabYPVRy3SCp8lBm14iKb9D2+4ZaFn8+UFYLemuE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Nndl8dJcp3KPfekGeOkG41AJIT0hgcjErZ83zCYNVUJ/wJ9aP9J1kZ9IcszlMCiGm+gPSvo4SEWZNQ4CSrR6+MEm+QT62F6iHQiB1enpKlNuL8G2iqoz+LU+I50h9qAvEwhlrIf2iQdrcdv0jhRnBNm7Kb/i60C0Q7bfitqb0/Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=S1by2Pj2; arc=none smtp.client-ip=209.85.128.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="S1by2Pj2" Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4954d29264cso3638825e9.2 for ; Wed, 19 Aug 2026 01:40:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787128800; x=1787733600; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=hjjUvOmK0OPOz9lxQcUSjqU8S6ZDd+xG7uAE7UP0M10=; b=S1by2Pj2MaUZsYIg13g4JD4X7mFW07Cd5PbflbkNJtKSdJY8EP7sXojHAsR1sgRvrG N6HLPGHMh0HVN8dm5pETVXJQFzdo3YYj+6QOlwaFtrQrmp7luYhmKH9vtWJGGZiC+q5N Dl6tZa/HIFf7EI7H5G+HNm7XvfN8DrWMSv7SaLMHBBrvLzoisCBL1CTgBxi56D8QkVj6 2nKWauPyjcrN3n5t6HIbVh6m2mduPm4LCakpYiuAc1gXvJznEhyDenHP5B26hA+0C2Lh KwkxoDtI6BRSxSKUKGmDEUldgtd9ghyPlCij42yOX0XEriQoW6SeCOZaNBhwGGAVWHDS IWcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787128800; x=1787733600; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=hjjUvOmK0OPOz9lxQcUSjqU8S6ZDd+xG7uAE7UP0M10=; b=ilSAO43058hxx8Ta9HRAZBt+g2QDvrguIjvaWM8ugl+Kzh6QcOo/YSkSrQPwqM2Ylc flocv9b91FWmH8qKPSUDLYc9gD5SR8vMwAvIGRyLoIVcXHgW/eOayi3+qASUhHKfdGIv 80IYis5LWgxeMYKpV1imy0FxYyZWjPmtmKf31zZM0ygDNndIrVlgmT7YIDMyD8lh9yqX f8AHzXn0bM9wpk/sE53ARb3fiu4oqcm19k47wqtWdx6kLSFeC/fyXaLYXczvZFlcL3NY ZJuSWz5bRAxH48ZzMzYlTOQ6IjtzlRBngrFYN/LlHPDeCrWuWGsTtY7p2bppJZSpWknE U74g== X-Gm-Message-State: AOJu0YzJXDRS/ZTtedpfl2x97UF53pjLxIz+jP7qx7hQK7QcNwRG+U5I HCfJ/jvT8coJIr5nx+rllhhG5PyUoS81IUvxTZOetadPSioAf8nlVcMD X-Gm-Gg: AR+sD12VHXQyhxjHRVdqTD9cmZRkIFESWxoOnygStIqnj7HyEwJeELy9Se32RS+eZg+ fzVwzAjCpZMn7qs9SLqISE3/yGl/4yinknx9piditr/TwbEYnZ31osJtIryLBa3HVfBKFKmkxsn KSm+PeTcu8qOGsDPOZFyUb/Cb/2xQDN++nnmpyVgQiY5F0wMsHzt8BARLvxrAqNtk9GJldTiGmE XuXci2BOAE1bSieGQQuyMf2v7vkRDPpk0cXBVsh3Jcw6pgBRPLeghfDyRLmvPw84RgGDibNb+GX cWEJdXkzoy9bCftI3YfO0O1Jx4LYhoI6bIg7ZGb2+0GdHOZWAvp/5eepELcloI4j+lC+0fNmho9 ywroTBULfv2I9hXVyJuFhi8IQZaWvwfzyCw7TvxRgOc56jKqTjh/EWVSU6Q82kw30fhLvKlMHnf YpKhaml46FC3nLqXytAcJiwcbeGxn7oMiAd8pgD+V4rPZtk3hasXqSJHmZzcpZCOAgokGp X-Received: by 2002:a05:600c:a012:b0:499:593b:a15b with SMTP id 5b1f17b1804b1-499aa1431a5mr56444255e9.1.1787128799811; Wed, 19 Aug 2026 01:39:59 -0700 (PDT) Received: from SurHub.localdomain ([196.188.112.82]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-499a9dff4c1sm33032205e9.3.2026.08.19.01.39.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 01:39:59 -0700 (PDT) From: Abdifatah Suruur To: xen-devel@lists.xenproject.org Cc: linux-kernel@vger.kernel.org, jgross@suse.com Subject: [PATCH] xen/gntdev: prevent private mappings from becoming writable Date: Wed, 19 Aug 2026 11:39:56 +0300 Message-ID: <20260819083956.1442-1-suruurism@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit gntdev_mmap() rejects writable private (non-shared) mappings of foreign grant pages, because a private writable mapping takes the COW path on pages that have no proper struct-page backing. However, VM_MAYWRITE is left set, so userspace can map the grant read-only and then upgrade the mapping to writable with mprotect(), hitting the same COW path the check was written to prevent. Clear VM_MAYWRITE for private mappings, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071) and ptp: vmclock (commit a5edadbae57e2298a56cf7a4e774a027905a331f). Fixes: ab31523c2fcac ("xen/gntdev: allow usermode to map granted pages") Cc: stable@vger.kernel.org Signed-off-by: Abdifatah Suruur --- diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c index 1dcc4675580ed..b71f5bae25b63 100644 --- a/drivers/xen/gntdev.c +++ b/drivers/xen/gntdev.c @@ -1066,6 +1066,13 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) if ((vma->vm_flags & VM_WRITE) && !(vma->vm_flags & VM_SHARED)) return -EINVAL; + /* + * Private mappings of foreign grant pages must never become + * writable: they would take the COW path on granted pages. + */ + if (!(vma->vm_flags & VM_SHARED)) + vm_flags_clear(vma, VM_MAYWRITE); + pr_debug("map %d+%d at %lx (pgoff %lx)\n", index, count, vma->vm_start, vma->vm_pgoff);