Re: [PATCH 2/7] vfio/fsl-mc: prevent read-only region mappings from becoming writable

[Alex Williamson <alex@shazbot.org>]

On Mon, 21 Sep 2026 15:23:29 +0300
Abdifatah Suruur <suruurism@gmail.com> wrote:

> vfio_fsl_mc_mmap() rejects writable mappings of regions without the
> WRITE flag, but leaves VM_MAYWRITE set.  Userspace can map such a region
> read-only and then upgrade the mapping to writable with mprotect().
> 
> Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for
> its read-only objects and as fixed in drm/vc4 (CVE-2026-68445),
> drm/panthor (CVE-2024-53071) and commit a5edadbae57e ("ptp: vmclock:
> prevent read-only mappings from becoming writable").
> 
> Note this is defensive hardening: the fsl-mc bus publishes all device
> regions with the WRITE flag set, so no device can currently reach the
> read-only path.  The guard costs nothing and keeps the mmap() interface
> honest if a read-only region ever appears.
> 
> Fixes: 67247289688d4 ("vfio/fsl-mc: Allow userspace to MMAP fsl-mc device MMIO regions")
> Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
> Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
> ---

There should be a diffstat here, check your git format-patch tooling.

> --- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c
> +++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c
> @@ -406,7 +406,11 @@
>  	if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE)
>  			&& (vma->vm_flags & VM_WRITE))
>  		return -EINVAL;
> 
> +	/* Prevent read-only region mappings from being upgraded with mprotect() */
> +	if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE))
> +		vm_flags_clear(vma, VM_MAYWRITE);
> +

Pranjal's suggestion for removing the duplicate flag test on the
platform patch should be applied here, and to the next patch for cdx as
well.  Thanks,

Alex

>  	vma->vm_private_data = mc_dev;
> 
>  	return vfio_fsl_mc_mmap_mmio(vdev->regions[index], vma);
>  }