Re: [PATCH] char: uv_mmtimer: prevent read-only mmtimer mapping from becoming writable

[Dimitri Sivanich]

On Wed, Aug 19, 2026 at 11:42:24AM +0300, Abdifatah Suruur wrote:
> uv_mmtimer_mmap() rejects writable mappings of the system-wide mmtimer
> register page, but leaves VM_MAYWRITE set.  Userspace can map the page
> read-only and then upgrade the mapping to writable with mprotect(),
> after which it can write to the shared RTC registers.
> 
> Clear VM_MAYWRITE on the read-only path, as i915 does for its read-only
> objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor
> (CVE-2024-53071) and ptp: vmclock (commit
> a5edadbae57e2298a56cf7a4e774a027905a331f).
> 
> Fixes: fbd8ae106850b ("char: add SGI UV mmtimer driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Abdifatah Suruur <suruurism@xxxxxxxxx>
>

Acked-by: Dimitri Sivanich <sivanich@xxxxxxx>