[PATCH] char: uv_mmtimer: prevent read-only mapping from becoming writable

[PATCH] char: uv_mmtimer: prevent read-only mapping from becoming writable

[bo cao]

uv_mmtimer_mmap() rejects writable mappings but leaves VM_MAYWRITE
set.  Userspace can map the clock's MMR page read-only and then
upgrade the mapping to writable with mprotect(), gaining write access
to the UVH_RTC register that the driver explicitly declares
read-only.

Clear VM_MAYWRITE, as fixed in vfio/platform (commit 420bed9131db),
drm/vc4 (CVE-2026-68445), drm/panthor (CVE-2024-53071) and
ptp/vmclock (commit a5edadbae57e).

Note this is defensive hardening on two counts: /dev/uv_mmtimer is
created with the default 0600 mode (exploitation requires root), and
the driver only exists on SGI UV systems.

Fixes: fbd8ae106850 ("drivers/char/uv_mmtimer.c: add memory mapped RTC driver for UV")
Signed-off-by: bo cao <treebacker@foxmail.com>
---
 drivers/char/uv_mmtimer.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/char/uv_mmtimer.c b/drivers/char/uv_mmtimer.c
index 956ebe2080a5..98b9c85c6529 100644
--- a/drivers/char/uv_mmtimer.c
+++ b/drivers/char/uv_mmtimer.c
@@ -151,9 +151,12 @@ static int uv_mmtimer_mmap(struct file *file, struct vm_area_struct *vma)
 	if (vma->vm_end - vma->vm_start != PAGE_SIZE)
 		return -EINVAL;
 
+	/* Prevent the read-only mapping from being upgraded with mprotect() */
 	if (vma->vm_flags & VM_WRITE)
 		return -EPERM;
 
+	vm_flags_clear(vma, VM_MAYWRITE);
+
 	if (PAGE_SIZE > (1 << 16))
 		return -ENOSYS;
 
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] char: uv_mmtimer: prevent read-only mapping from becoming writable

[Greg KH]

On Thu, Oct 29, 2026 at 11:54:13AM +0800, bo cao wrote:
> uv_mmtimer_mmap() rejects writable mappings but leaves VM_MAYWRITE
> set.  Userspace can map the clock's MMR page read-only and then
> upgrade the mapping to writable with mprotect(), gaining write access
> to the UVH_RTC register that the driver explicitly declares
> read-only.
> 
> Clear VM_MAYWRITE, as fixed in vfio/platform (commit 420bed9131db),
> drm/vc4 (CVE-2026-68445), drm/panthor (CVE-2024-53071) and
> ptp/vmclock (commit a5edadbae57e).
> 
> Note this is defensive hardening on two counts: /dev/uv_mmtimer is
> created with the default 0600 mode (exploitation requires root), and
> the driver only exists on SGI UV systems.
> 
> Fixes: fbd8ae106850 ("drivers/char/uv_mmtimer.c: add memory mapped RTC driver for UV")
> Signed-off-by: bo cao <treebacker@foxmail.com>
> ---
>  drivers/char/uv_mmtimer.c | 3 +++
>  1 file changed, 3 insertions(+)

Your LLM just picked up a patch I sent previously:
	https://lore.kernel.org/r/2026102752-extrovert-undaunted-d6cb@gregkh

thanks,

greg k-h

Re: [PATCH] char: uv_mmtimer: prevent read-only mapping from becoming writable

[bo cao]

Understood -- please consider this version withdrawn; your patch
covers it.

For what it is worth: my duplicate check is automated, and
lore.kernel.org is behind an anti-scraping challenge (Anubis), so the
list archive was not machine-searchable from my tooling -- that is
how the duplicate slipped through.  Before posting future patches I
will manually search the archive for the relevant keywords (file
names, subsystem, subject lines) to confirm no existing patch already
covers the same ground.

Apologies for the noise,

bo cao