[PATCH] fpga: dfl: afu: prevent read-only region mappings from becoming writable

[PATCH] fpga: dfl: afu: prevent read-only region mappings from becoming writable

[bo cao]

afu_mmap() rejects writable mappings of regions without the WRITE
flag, but leaves VM_MAYWRITE set.  Userspace can map such a region
read-only and then upgrade the mapping to writable with mprotect().

Clear VM_MAYWRITE for regions without the WRITE flag, as fixed in
vfio/platform (commit 420bed9131db), drm/vc4 (CVE-2026-68445),
drm/panthor (CVE-2024-53071) and ptp/vmclock (commit a5edadbae57e).

Note this is defensive hardening: the in-tree callers of
afu_mmio_region_add() (port_afu_init() and port_stp_init()) all
register their regions with DFL_PORT_REGION_WRITE.  The guard costs
nothing and keeps the mmap() interface honest if a read-only region
ever appears.

Fixes: 857a26222ff7 ("fpga: dfl: afu: add afu sub feature support")
Signed-off-by: bo cao <treebacker@foxmail.com>
---
 drivers/fpga/dfl-afu-main.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/fpga/dfl-afu-main.c b/drivers/fpga/dfl-afu-main.c
index 097a97eeea66..a802309e0473 100644
--- a/drivers/fpga/dfl-afu-main.c
+++ b/drivers/fpga/dfl-afu-main.c
@@ -833,9 +833,13 @@ static int afu_mmap(struct file *filp, struct vm_area_struct *vma)
 	if ((vma->vm_flags & VM_READ) && !(region.flags & DFL_PORT_REGION_READ))
 		return -EPERM;
 
-	if ((vma->vm_flags & VM_WRITE) &&
-	    !(region.flags & DFL_PORT_REGION_WRITE))
-		return -EPERM;
+	/* Prevent read-only region mappings from being upgraded with mprotect() */
+	if (!(region.flags & DFL_PORT_REGION_WRITE)) {
+		if (vma->vm_flags & VM_WRITE)
+			return -EPERM;
+
+		vm_flags_clear(vma, VM_MAYWRITE);
+	}
 
 	/* Support debug access to the mapping */
 	vma->vm_ops = &afu_vma_ops;
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] fpga: dfl: afu: prevent read-only region mappings from becoming writable

[Xu Yilun]

On Thu, Oct 29, 2026 at 11:53:17AM +0800, bo cao wrote:
> afu_mmap() rejects writable mappings of regions without the WRITE
> flag, but leaves VM_MAYWRITE set.  Userspace can map such a region
> read-only and then upgrade the mapping to writable with mprotect().
> 
> Clear VM_MAYWRITE for regions without the WRITE flag, as fixed in
> vfio/platform (commit 420bed9131db), drm/vc4 (CVE-2026-68445),
> drm/panthor (CVE-2024-53071) and ptp/vmclock (commit a5edadbae57e).

Interesting, people write exact same changelog. I'm not sure if it is a
sign that AI generated it and just sent. I don't reject AI entirely, but
please write the changelog and comments by hand, to give me the
confidence that you really know the change.

Or maybe I'm wrong, you saw other's patch and copied it. Please don't.
If you really want to improve something, comment on that patch.

Even if you are sure the thread is dead and you revive it, reference the
original thread and the author.

> 
> Note this is defensive hardening: the in-tree callers of
> afu_mmio_region_add() (port_afu_init() and port_stp_init()) all
> register their regions with DFL_PORT_REGION_WRITE.  The guard costs
> nothing and keeps the mmap() interface honest if a read-only region
> ever appears.
> 
> Fixes: 857a26222ff7 ("fpga: dfl: afu: add afu sub feature support")
> Signed-off-by: bo cao <treebacker@foxmail.com>
> ---
>  drivers/fpga/dfl-afu-main.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/fpga/dfl-afu-main.c b/drivers/fpga/dfl-afu-main.c
> index 097a97eeea66..a802309e0473 100644
> --- a/drivers/fpga/dfl-afu-main.c
> +++ b/drivers/fpga/dfl-afu-main.c
> @@ -833,9 +833,13 @@ static int afu_mmap(struct file *filp, struct vm_area_struct *vma)
>  	if ((vma->vm_flags & VM_READ) && !(region.flags & DFL_PORT_REGION_READ))
>  		return -EPERM;
>  
> -	if ((vma->vm_flags & VM_WRITE) &&
> -	    !(region.flags & DFL_PORT_REGION_WRITE))
> -		return -EPERM;
> +	/* Prevent read-only region mappings from being upgraded with mprotect() */
> +	if (!(region.flags & DFL_PORT_REGION_WRITE)) {
> +		if (vma->vm_flags & VM_WRITE)
> +			return -EPERM;
> +
> +		vm_flags_clear(vma, VM_MAYWRITE);
> +	}
>  
>  	/* Support debug access to the mapping */
>  	vma->vm_ops = &afu_vma_ops;
> -- 
> 2.39.5 (Apple Git-154)
> 
> 

Re: [PATCH] fpga: dfl: afu: prevent read-only region mappings from becoming writable

[bo cao]

Please consider this patch withdrawn: Abdifatah Suruur's patch
already covers it, and his v2 was posted to linux-fpga on Oct 23,
six days before my posting.

To be clear about where this came from: it is not taken from
Suruur's patch.  I run an AI-agent-assisted audit of mmap/mprotect
permission handling, and it independently flagged afu_mmap() as
leaving VM_MAYWRITE set on regions without DFL_PORT_REGION_WRITE,
and drafted the fix.  Two fixes of the same one-line issue, citing
the same precedent commits of this pattern, necessarily read alike
-- but I understand that from your side the result is
indistinguishable from a copy, and the concern is legitimate.

The pre-send duplicate check in my tooling queries lore.kernel.org,
which is behind an anti-bot challenge, so it returned nothing and
the overlap with Suruur's live thread slipped through.  I should
not have relied on it alone.  I'm sorry for the noise.

Going forward I will manually search the list archive (marc.info,
openwall mirrors) before sending anything, and I will write the
changelog and comments by hand, so that what reaches you reflects
my own understanding of the change.  Where my audit finds an issue
that an existing thread already covers, I will comment on that
thread instead of sending a duplicate.

Apologies,
Bo Cao