Re: [PATCH] vfio/platform: keep logical vm_pgoff in MMIO region mmap

[Alex Williamson]

On Thu,  3 Sep 2026 12:29:27 +0300
Abdifatah Suruur <suruurism@xxxxxxxxx> wrote:

> vfio_platform_mmap_mmio() overwrites vma->vm_pgoff with the physical
> frame number of the MMIO region and passes it to remap_pfn_range().
> The VMA is inserted into the device file's mapping->i_mmap interval
> tree keyed by vm_pgoff, which VFIO expects to be the logical file
> offset: the core links every device mmap to the device inode's
> i_mapping precisely so that unmap_mapping_range() can revoke all
> mappings associated with a device (see vfio_device_cdev_open()).
> 
> With a raw PFN in vm_pgoff the interval tree entry lands in the wrong
> coordinate space and unmap_mapping_range() cannot find the VMA,
> leaving stale MMIO mappings behind any revocation attempt.  Keep
> vm_pgoff in the logical VFIO offset space, as vfio-pci does, and pass
> the physical PFN to remap_pfn_range() explicitly.
> 
> Fixes: fad4d5b1f042a ("vfio/platform: support MMAP of MMIO regions")
> Signed-off-by: Abdifatah Suruur <suruurism@xxxxxxxxx>
> 
> ---
> --- a/drivers/vfio/platform/vfio_platform_common.c
> +++ b/drivers/vfio/platform/vfio_platform_common.c
> @@ -559,6 +559,5 @@
>  	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
> -	vma->vm_pgoff = (region.addr >> PAGE_SHIFT) + pgoff;
> -
> -	return remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
> +	return remap_pfn_range(vma, vma->vm_start,
> +			       (region.addr >> PAGE_SHIFT) + pgoff,
>  			       req_len, vma->vm_page_prot);
>  }

Like the read-only mapping fixes, this is a hygiene issue, none of
platform, fsl-mc, or cdx actually make use of unmap_mapping_range() to
expose such an issue.  That should be noted in the cover letter for
proper scoping.

This also applies to the cdx non-shared mmaps.

Also, please just group all 7 patches you have on the list into a
single series.  They're all hygiene/hardening, they're doing the same
thing through different vfio bus drivers, they're much easier for me to
track as a series.

The Fixes: tags throughout are also somewhat suspect.  It's reasonable
hardening to clear VM_MAYWRITE for a !VFIO_REGION_INFO_FLAG_WRITE
region, but if there are no !VFIO_REGION_INFO_FLAG_WRITE regions, it's
not really fixing anything.

It's more arguable that there's a latent issue here where
unmap_mapping_range() would fail, but even if we consider that worth a
Fixes: tag, the attribution is wrong.  We didn't introduce that shared
namespace until b7c5e64fecfa.  TBH, it's not a reachable issue in the
codebase, I'd drop it.  Thanks,

Alex