diff options
| author | Abdifatah Suruur <suruurism@gmail.com> | 2026-09-29 12:48:43 +0300 |
|---|---|---|
| committer | Alex Williamson <alex@shazbot.org> | 2026-09-29 13:30:48 -0600 |
| commit | 25fd8b27ee8d4f59cc2ad99cf67aef4570b82096 (patch) | |
| tree | cb35a1c313ba22f8f13d1fdb85389c6afa25edf9 /tools/perf/scripts/python | |
| parent | 420bed9131dbbe37abe9d6b32af51219875811e0 (diff) | |
| download | linux-next-25fd8b27ee8d4f59cc2ad99cf67aef4570b82096.tar.gz linux-next-25fd8b27ee8d4f59cc2ad99cf67aef4570b82096.zip | |
vfio/fsl-mc: prevent read-only region mappings from becoming writable
vfio_fsl_mc_mmap() rejects writable mappings of regions without the
WRITE flag, but leaves VM_MAYWRITE set. Userspace can map such a region
read-only and then upgrade the mapping to writable with mprotect().
Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for
its read-only objects and as fixed in drm/vc4 (CVE-2026-68445),
drm/panthor (CVE-2024-53071) and commit a5edadbae57e ("ptp: vmclock:
prevent read-only mappings from becoming writable").
Note this is defensive hardening: the fsl-mc bus publishes all device
regions with the WRITE flag set, so no device can currently reach the
read-only path. The guard costs nothing and keeps the mmap() interface
honest if a read-only region ever appears.
Fixes: 67247289688d4 ("vfio/fsl-mc: Allow userspace to MMAP fsl-mc device MMIO regions")
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Link: https://lore.kernel.org/r/20260929094848.7439-3-suruurism@gmail.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions