Re: [PATCH] vfio/fsl-mc: prevent read-only region mappings from becoming writable

[Alex Williamson]

On Wed, 19 Aug 2026 11:42:09 +0300
Abdifatah Suruur <suruurism@xxxxxxxxx> wrote:

> vfio_fsl_mc_mmap() rejects writable mappings of regions without the
> WRITE flag, but leaves VM_MAYWRITE set.  Userspace can map such a region
> read-only and then upgrade the mapping to writable with mprotect(),
> writing to MMIO regions (e.g. response portals) the device marks
> read-only.
> 
> Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for
> its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and
> drm/panthor (CVE-2024-53071) and ptp: vmclock (commit
> a5edadbae57e2298a56cf7a4e774a027905a331f).

In reference to both this and the platform version of the same, this is
being positioned relative to CVE fixes, but while these drivers do
include support for exposing read-only regions, it appears there are no
devices that report a read-only region and it's apparently
mathematically impossible for fsl-mc to do so.

They're still logical fixes, they still appear valid, but the commit log
should be blunt that these are effectively unreachable.  Thanks,

Alex

PS.

$ ./scripts/get_maintainer.pl -f drivers/vfio/platform/
Eric Auger <eric.auger@xxxxxxxxxx> (maintainer:VFIO PLATFORM DRIVER)
Mostafa Saleh <smostafa@xxxxxxxxxx> (reviewer:VFIO PLATFORM DRIVER)
Pranjal Shrivastava <praan@xxxxxxxxxx> (reviewer:VFIO PLATFORM DRIVER)
Alex Williamson <alex@xxxxxxxxxxx> (maintainer:VFIO DRIVER)
kvm@xxxxxxxxxxxxxxx (open list:VFIO PLATFORM DRIVER)
linux-kernel@xxxxxxxxxxxxxxx (open list)

$ ./scripts/get_maintainer.pl -f drivers/vfio/fsl-mc/
Ioana Ciornei <ioana.ciornei@xxxxxxx> (maintainer:VFIO FSL-MC DRIVER)
Alex Williamson <alex@xxxxxxxxxxx> (maintainer:VFIO DRIVER)
kvm@xxxxxxxxxxxxxxx (open list:VFIO FSL-MC DRIVER)
linux-kernel@xxxxxxxxxxxxxxx (open list)
 
> Fixes: fb1ff4c194157 ("vfio/fsl-mc: Add VFIO framework skeleton for fsl-mc devices")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Abdifatah Suruur <suruurism@xxxxxxxxx>
> 
> ---
> --- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c
> +++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c
> @@ -406,7 +406,11 @@
>  	if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE)
>  			&& (vma->vm_flags & VM_WRITE))
>  		return -EINVAL;
> 
> +	/* Prevent read-only region mappings from being upgraded with mprotect() */
> +	if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE))
> +		vm_flags_clear(vma, VM_MAYWRITE);
> +
>  	vma->vm_private_data = mc_dev;
> 
>  	return vfio_fsl_mc_mmap_mmio(vdev->regions[index], vma);
>  }
>