diff options
| author | Abdifatah Suruur <suruurism@gmail.com> | 2026-08-19 11:42:17 +0300 |
|---|---|---|
| committer | Juergen Gross <jgross@suse.com> | 2026-10-09 09:58:46 +0200 |
| commit | 2176dea8d8c19cb43a9b3651bfa1cb21eab1b31a (patch) | |
| tree | 5f511153a2f6160b3517e59a94ad35ea626fc2f5 /tools/perf/scripts/python | |
| parent | fe2eea9afbc4727ec972ec8dd4ff1480a5333bab (diff) | |
| download | linux-2176dea8d8c19cb43a9b3651bfa1cb21eab1b31a.tar.gz linux-2176dea8d8c19cb43a9b3651bfa1cb21eab1b31a.zip | |
xen/gntdev: prevent private mappings from becoming writable
gntdev_mmap() rejects writable private (non-shared) mappings of foreign
grant pages, because a private writable mapping takes the COW path on
pages that have no proper struct-page backing. However, VM_MAYWRITE is
left set, so userspace can map the grant read-only and then upgrade the
mapping to writable with mprotect(), hitting the same COW path the
check was written to prevent.
Clear VM_MAYWRITE for private mappings, as i915 does for its read-only
objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor
(CVE-2024-53071) and ptp: vmclock (commit
a5edadbae57e2298a56cf7a4e774a027905a331f).
Fixes: ab31523c2fcac ("xen/gntdev: allow usermode to map granted pages")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260819084217.1577-1-suruurism@gmail.com>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions