Re: [PATCH] ALSA: us122l: Prevent write upgrades for read mappings

[Takashi Iwai]

On Tue, 08 Sep 2026 13:00:53 +0200,
Kazuki Hanai wrote:
> 
> The hwdep mmap callback rejects read-buffer mappings that are initially
> writable, but leaves VM_MAYWRITE set on mappings created with PROT_READ.
> A process that can open the hwdep node O_RDWR can later use mprotect() to
> make the mapping writable.
> 
> The read allocation begins with struct usb_stream. Its read_size member is
> used by the fault handler to decide which pages belong to the read buffer.
> The read VMA intentionally remains expandable because pcm_usb_stream uses
> mremap() after reading that size. Changing read_size first can therefore
> map and access pages beyond the allocation. The same member is also
> consumed by usb_stream_free(), where changing it can make
> free_pages_exact() release pages outside the allocation.
> 
> Clear VM_MAYWRITE for read-buffer mappings after rejecting an initially
> writable VMA. This keeps the separate output-buffer mapping writable while
> preventing later permission upgrades.
> 
> Fixes: 030a07e44129 ("ALSA: Add USB US122L driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Kazuki Hanai <hnkz.64@xxxxxxxxx>

Applied now.  Thanks.


Takashi