Re: [PATCH v2] fpga: dfl: afu: prevent read-only port mappings from becoming writable

[Xu Yilun]

On Fri, Oct 23, 2026 at 04:44:01AM -0700, Abdifatah Suruur wrote:
> afu_mmap() rejects writable mappings of port regions without the WRITE
> flag, but leaves VM_MAYWRITE set.  Userspace can map such a region
> read-only and then upgrade the mapping to writable with mprotect(),
> writing to FPGA port control/status registers the host owns.  A guest
> assigned an AFU can use this to reconfigure or reset the port and
> interfere with other tenants on the same FPGA.
> 
> Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for
> its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and
> drm/panthor (CVE-2024-53071) and ptp: vmclock (commit
> a5edadbae57e2298a56cf7a4e774a027905a331f).
> 
> Fixes: 1a1527cf5dda ("fpga: dfl: add FPGA Accelerated Function Unit driver basic framework")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Abdifatah Suruur <suruurism@xxxxxxxxx>
> 
> ---
> v2: use a 12-character commit id in the Fixes tag, as requested.
> 
> --- a/drivers/fpga/dfl-afu-main.c
> +++ b/drivers/fpga/dfl-afu-main.c
> @@ -836,7 +836,11 @@
>  	if ((vma->vm_flags & VM_WRITE) &&
>  	    !(region.flags & DFL_PORT_REGION_WRITE))
>  		return -EPERM;
> 
> +	/* Prevent read-only port mappings from being upgraded with mprotect() */
> +	if (!(region.flags & DFL_PORT_REGION_WRITE))
> +		vm_flags_clear(vma, VM_MAYWRITE);

The reason seems sound, but as a fix, is there a real problem to solve?
AFAICS, every region allows everything.

If a cleanup is really wanted, I'd rather delete all these flag
assigning and checking, until any real use case comes.

> +
>  	/* Support debug access to the mapping */
>  	vma->vm_ops = &afu_vma_ops;
> 
>  	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
>