Re: [PATCH v2 7/7] vfio/cdx: reject non-shared MMIO mmaps

[Alex Williamson]

On Tue, 29 Sep 2026 12:48:48 +0300
Abdifatah Suruur <suruurism@xxxxxxxxx> wrote:

> vfio_cdx_mmap() accepts MAP_PRIVATE mappings.  A non-shared mapping
> with VM_MAYWRITE is a COW mapping, and remap_pfn_range()'s COW special
> case in get_remap_pgoff() then overwrites vma->vm_pgoff with the
> physical frame number:
> 
> 	if (is_cow) {
> 		if (addr != vm_start || end != vm_end)
> 			return -EINVAL;
> 		*vm_pgoff_p = pfn;
> 	}
> 
> The VMA is inserted into the device file's mapping->i_mmap interval
> tree keyed by vm_pgoff, which VFIO expects to be the logical file
> offset: the core links every device mmap to the device inode's
> i_mapping precisely so that unmap_mapping_range() can revoke all
> mappings associated with a device (see vfio_device_cdev_open()).

It's actually vfio_device_open_file() and vfio_device_fops_cdev_open(),
vfio_device_cdev_open() doesn't exist.
 
> A raw PFN in vm_pgoff lands the interval tree entry in the wrong
> coordinate space, so unmap_mapping_range() cannot find the VMA and a
> stale MMIO mapping survives any revocation attempt.  Without this
> check, a MAP_PRIVATE mapping reintroduces that corruption even with
> the logical-vm_pgoff fix in place.
> 
> Require VM_SHARED as vfio-pci, vfio/fsl-mc and vfio/platform already

vfio-fsl-mc and vfio-platform for consistency.

Applied series with these changes to vfio next branch for v7.4.  Thanks,

Alex

> do.  This is defensive hygiene: vfio-cdx does not call
> unmap_mapping_range() today, so no reachable stale-mapping issue
> exists.
> 
> Signed-off-by: Abdifatah Suruur <suruurism@xxxxxxxxx>
> ---
>  drivers/vfio/cdx/main.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/vfio/cdx/main.c b/drivers/vfio/cdx/main.c
> index ea55b7767672c..28dc8c8256006 100644
> --- a/drivers/vfio/cdx/main.c
> +++ b/drivers/vfio/cdx/main.c
> @@ -271,6 +271,9 @@ static int vfio_cdx_mmap(struct vfio_device *core_vdev,
>  
>  	index = vma->vm_pgoff >> (VFIO_CDX_OFFSET_SHIFT - PAGE_SHIFT);
>  
> +	if (!(vma->vm_flags & VM_SHARED))
> +		return -EINVAL;
> +
>  	if (index >= cdx_dev->res_count)
>  		return -EINVAL;
>