Re: [PATCH v6 16/39] mm/vma: only allow mmap to clear VMA_MAYWRITE_BIT if not mm-managed

[David Carlier]

Hi Lorenzo,

I think one site was missed: usb_stream_hwdep_mmap() in
sound/usb/usx2y/us122l.c clears VM_MAYWRITE on the read buffer since
71c610aeb177 ("ALSA: us122l: Prevent write upgrades for read mappings"),
but sets neither VM_PFNMAP nor VM_MIXEDMAP (pages come from .fault via
vmf->page, like the PCM status page in 13/39).

So a MAP_PRIVATE mapping of the read buffer, or MAP_SHARED on an O_RDWR
fd, now hits the WARN_ON_ONCE in mmap_validate() and fails with -EINVAL.

The VM_MAYWRITE clear is a security fix, and the VMA must stay
expandable for mremap(), so converting it like 13/39 or setting
VM_MIXEDMAP seems the way to go.

Found by code reading, not tested on hardware.

Cheers