[PATCH] dma-buf: system_heap: Reject private mappings in system_heap_mmap()

[PATCH] dma-buf: system_heap: Reject private mappings in system_heap_mmap()

[Chris Wiseman]

When commit 381295758792 ("dma-buf: system_heap: Rework system heap to
use sgtables instead of pagelists") stopped using heap_helpers.c and
added a custom system_heap_mmap(), the check rejecting private mappings
was dropped.

Other exporters and buffer allocators reject private or copy-on-write
mappings in their mmap handlers: cma_heap_mmap() and mmap_udmabuf()
check that VM_SHARED or VM_MAYSHARE is set, and drm_gem_shmem_mmap()
and ttm_bo_mmap_obj() reject vma_is_cow_mapping(vma).

However, system_heap_mmap() omits this check and calls remap_pfn_range()
even when userspace requests MAP_PRIVATE with PROT_WRITE. As a result,
subsequent CPU writes to a MAP_PRIVATE mapping of a system heap buffer
fault into do_wp_page() -> wp_page_copy(), silently allocating private
anonymous copy-on-write pages whose writes never reach the underlying
system heap buffer pages.

Reject non-shared mappings in system_heap_mmap() with -EINVAL to match
cma_heap_mmap() and mmap_udmabuf().

Fixes: 381295758792 ("dma-buf: system_heap: Rework system heap to use sgtables instead of pagelists")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Wiseman <chriswiseman@google.com>
---
 drivers/dma-buf/heaps/system_heap.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c
index 1ef1bb3acbf1..f668dc8cb54a 100644
--- a/drivers/dma-buf/heaps/system_heap.c
+++ b/drivers/dma-buf/heaps/system_heap.c
@@ -235,6 +235,9 @@ static int system_heap_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
 	pgprot_t prot;
 	int i, ret;
 
+	if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) == 0)
+		return -EINVAL;
+
 	prot = vma->vm_page_prot;
 	if (cc_shared_buffer(buffer))
 		prot = pgprot_decrypted(prot);
-- 
2.56.0.317.g454f8302e1-goog

Re: [PATCH] dma-buf: system_heap: Reject private mappings in system_heap_mmap()

[T.J. Mercier]

On Fri, Oct 30, 2026 at 1:44 PM Chris Wiseman <chriswiseman@google.com> wrote:
>
> When commit 381295758792 ("dma-buf: system_heap: Rework system heap to
> use sgtables instead of pagelists") stopped using heap_helpers.c and
> added a custom system_heap_mmap(), the check rejecting private mappings
> was dropped.
>
> Other exporters and buffer allocators reject private or copy-on-write
> mappings in their mmap handlers: cma_heap_mmap() and mmap_udmabuf()
> check that VM_SHARED or VM_MAYSHARE is set, and drm_gem_shmem_mmap()
> and ttm_bo_mmap_obj() reject vma_is_cow_mapping(vma).
>
> However, system_heap_mmap() omits this check and calls remap_pfn_range()
> even when userspace requests MAP_PRIVATE with PROT_WRITE. As a result,
> subsequent CPU writes to a MAP_PRIVATE mapping of a system heap buffer
> fault into do_wp_page() -> wp_page_copy(), silently allocating private
> anonymous copy-on-write pages whose writes never reach the underlying
> system heap buffer pages.
>
> Reject non-shared mappings in system_heap_mmap() with -EINVAL to match
> cma_heap_mmap() and mmap_udmabuf().
>
> Fixes: 381295758792 ("dma-buf: system_heap: Rework system heap to use sgtables instead of pagelists")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chris Wiseman <chriswiseman@google.com>

Reviewed-by: T.J. Mercier <tjmercier@google.com>

I wonder if we should have this in dma_buf_mmap_internal() though. Any
thoughts Sumit or Christian?