[PATCH] char: uv_mmtimer: prevent read-only mapping from becoming writable

[bo cao <treebacker@foxmail.com>]

uv_mmtimer_mmap() rejects writable mappings but leaves VM_MAYWRITE
set.  Userspace can map the clock's MMR page read-only and then
upgrade the mapping to writable with mprotect(), gaining write access
to the UVH_RTC register that the driver explicitly declares
read-only.

Clear VM_MAYWRITE, as fixed in vfio/platform (commit 420bed9131db),
drm/vc4 (CVE-2026-68445), drm/panthor (CVE-2024-53071) and
ptp/vmclock (commit a5edadbae57e).

Note this is defensive hardening on two counts: /dev/uv_mmtimer is
created with the default 0600 mode (exploitation requires root), and
the driver only exists on SGI UV systems.

Fixes: fbd8ae106850 ("drivers/char/uv_mmtimer.c: add memory mapped RTC driver for UV")
Signed-off-by: bo cao <treebacker@foxmail.com>
---
 drivers/char/uv_mmtimer.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/char/uv_mmtimer.c b/drivers/char/uv_mmtimer.c
index 956ebe2080a5..98b9c85c6529 100644
--- a/drivers/char/uv_mmtimer.c
+++ b/drivers/char/uv_mmtimer.c
@@ -151,9 +151,12 @@ static int uv_mmtimer_mmap(struct file *file, struct vm_area_struct *vma)
 	if (vma->vm_end - vma->vm_start != PAGE_SIZE)
 		return -EINVAL;
 
+	/* Prevent the read-only mapping from being upgraded with mprotect() */
 	if (vma->vm_flags & VM_WRITE)
 		return -EPERM;
 
+	vm_flags_clear(vma, VM_MAYWRITE);
+
 	if (PAGE_SIZE > (1 << 16))
 		return -ENOSYS;
 
-- 
2.39.5 (Apple Git-154)