Re: [PATCH] fpga: dfl: afu: prevent read-only region mappings from becoming writable

[Xu Yilun]

On Thu, Oct 29, 2026 at 11:53:17AM +0800, bo cao wrote:
> afu_mmap() rejects writable mappings of regions without the WRITE
> flag, but leaves VM_MAYWRITE set.  Userspace can map such a region
> read-only and then upgrade the mapping to writable with mprotect().
> 
> Clear VM_MAYWRITE for regions without the WRITE flag, as fixed in
> vfio/platform (commit 420bed9131db), drm/vc4 (CVE-2026-68445),
> drm/panthor (CVE-2024-53071) and ptp/vmclock (commit a5edadbae57e).

Interesting, people write exact same changelog. I'm not sure if it is a
sign that AI generated it and just sent. I don't reject AI entirely, but
please write the changelog and comments by hand, to give me the
confidence that you really know the change.

Or maybe I'm wrong, you saw other's patch and copied it. Please don't.
If you really want to improve something, comment on that patch.

Even if you are sure the thread is dead and you revive it, reference the
original thread and the author.

> 
> Note this is defensive hardening: the in-tree callers of
> afu_mmio_region_add() (port_afu_init() and port_stp_init()) all
> register their regions with DFL_PORT_REGION_WRITE.  The guard costs
> nothing and keeps the mmap() interface honest if a read-only region
> ever appears.
> 
> Fixes: 857a26222ff7 ("fpga: dfl: afu: add afu sub feature support")
> Signed-off-by: bo cao <treebacker@xxxxxxxxxxx>
> ---
>  drivers/fpga/dfl-afu-main.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/fpga/dfl-afu-main.c b/drivers/fpga/dfl-afu-main.c
> index 097a97eeea66..a802309e0473 100644
> --- a/drivers/fpga/dfl-afu-main.c
> +++ b/drivers/fpga/dfl-afu-main.c
> @@ -833,9 +833,13 @@ static int afu_mmap(struct file *filp, struct vm_area_struct *vma)
>  	if ((vma->vm_flags & VM_READ) && !(region.flags & DFL_PORT_REGION_READ))
>  		return -EPERM;
>  
> -	if ((vma->vm_flags & VM_WRITE) &&
> -	    !(region.flags & DFL_PORT_REGION_WRITE))
> -		return -EPERM;
> +	/* Prevent read-only region mappings from being upgraded with mprotect() */
> +	if (!(region.flags & DFL_PORT_REGION_WRITE)) {
> +		if (vma->vm_flags & VM_WRITE)
> +			return -EPERM;
> +
> +		vm_flags_clear(vma, VM_MAYWRITE);
> +	}
>  
>  	/* Support debug access to the mapping */
>  	vma->vm_ops = &afu_vma_ops;
> -- 
> 2.39.5 (Apple Git-154)
> 
>