[PATCH] fpga: dfl: afu: prevent read-only region mappings from becoming writable

[bo cao <treebacker@foxmail.com>]

afu_mmap() rejects writable mappings of regions without the WRITE
flag, but leaves VM_MAYWRITE set.  Userspace can map such a region
read-only and then upgrade the mapping to writable with mprotect().

Clear VM_MAYWRITE for regions without the WRITE flag, as fixed in
vfio/platform (commit 420bed9131db), drm/vc4 (CVE-2026-68445),
drm/panthor (CVE-2024-53071) and ptp/vmclock (commit a5edadbae57e).

Note this is defensive hardening: the in-tree callers of
afu_mmio_region_add() (port_afu_init() and port_stp_init()) all
register their regions with DFL_PORT_REGION_WRITE.  The guard costs
nothing and keeps the mmap() interface honest if a read-only region
ever appears.

Fixes: 857a26222ff7 ("fpga: dfl: afu: add afu sub feature support")
Signed-off-by: bo cao <treebacker@foxmail.com>
---
 drivers/fpga/dfl-afu-main.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/fpga/dfl-afu-main.c b/drivers/fpga/dfl-afu-main.c
index 097a97eeea66..a802309e0473 100644
--- a/drivers/fpga/dfl-afu-main.c
+++ b/drivers/fpga/dfl-afu-main.c
@@ -833,9 +833,13 @@ static int afu_mmap(struct file *filp, struct vm_area_struct *vma)
 	if ((vma->vm_flags & VM_READ) && !(region.flags & DFL_PORT_REGION_READ))
 		return -EPERM;
 
-	if ((vma->vm_flags & VM_WRITE) &&
-	    !(region.flags & DFL_PORT_REGION_WRITE))
-		return -EPERM;
+	/* Prevent read-only region mappings from being upgraded with mprotect() */
+	if (!(region.flags & DFL_PORT_REGION_WRITE)) {
+		if (vma->vm_flags & VM_WRITE)
+			return -EPERM;
+
+		vm_flags_clear(vma, VM_MAYWRITE);
+	}
 
 	/* Support debug access to the mapping */
 	vma->vm_ops = &afu_vma_ops;
-- 
2.39.5 (Apple Git-154)