Re: [PATCH v6 16/39] mm/vma: only allow mmap to clear VMA_MAYWRITE_BIT if not mm-managed

[Lorenzo Stoakes (ARM)]

On Sun, Oct 18, 2026 at 03:59:05AM +0100, David Carlier wrote:
> Hi Lorenzo,
>
> I think one site was missed: usb_stream_hwdep_mmap() in
> sound/usb/usx2y/us122l.c clears VM_MAYWRITE on the read buffer since
> 71c610aeb177 ("ALSA: us122l: Prevent write upgrades for read mappings"),
> but sets neither VM_PFNMAP nor VM_MIXEDMAP (pages come from .fault via
> vmf->page, like the PCM status page in 13/39).
>
> So a MAP_PRIVATE mapping of the read buffer, or MAP_SHARED on an O_RDWR
> fd, now hits the WARN_ON_ONCE in mmap_validate() and fails with -EINVAL.
>
> The VM_MAYWRITE clear is a security fix, and the VMA must stay
> expandable for mremap(), so converting it like 13/39 or setting
> VM_MIXEDMAP seems the way to go.
>
> Found by code reading, not tested on hardware.

Thanks. I will check it. Somebody doing something broken as a fix is fun.

It might be better to fix that with a separate patch, I don't think it really
makes sense to add a brand new patch to this series just for that.

I will follow that up.

--
Cheers, Lorenzo