From nobody Thu Sep 24 18:40:04 2026 Received: from mail-ed2-f12.google.com (mail-ed2-f12.google.com [74.125.228.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 732E34968EC for ; Mon, 21 Sep 2026 12:23:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.76 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993425; cv=none; b=dprdOM+jQQqzXcDEpPwY/gXmZIKL/W817JQc1DDQnvJuKIlae62lj1fL3XxcojW3fY2hrHlrdeGn1NffPCE+gSVf48hEVYnuY7zO7MN7Ip2kHzxkK+J4bqQ/TPZjhQYWzjBSVNZy3OS8AJywPCg8M+8GI9O4Kgt7m2jzE4BKGck= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993425; c=relaxed/simple; bh=F9zJRMikI9WeEBIIzxSya6IfDY6kvRKp1F8o4LGQzf8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LAq30kd9Rvqwq8gptdc4K9g19Da/ZSFah8umqOljx5HVNZDfCl9wGvhsIGU81LKiuLs1hVgaa0gOwsZPf5DsiCaz87Hr2Is2RzzDkO8QUSDX+e5+o/HO2fnc01BERBDfzfVf0n45AfmNd0NR8+xJkQ36e6kPykGBQ8za5Aj+AGE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=UCX7K/sI; arc=none smtp.client-ip=74.125.228.76 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="UCX7K/sI" Received: by mail-ed2-f12.google.com with SMTP id 4fb4d7f45d1cf-6a98505364aso4776281a12.3 for ; Mon, 21 Sep 2026 05:23:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789993421; x=1790598221; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=9PtmaD+dFfANavdWfY8E3JvcpIeWj4J1LbV7u+lXUeA=; b=UCX7K/sIVjf2qokVrACZS3RRa5rPfwk5NegBTGzsGcPSmOdbmardwYogktPkmPob1q 12BFPP7CxXcas2tQCPq1UsfkjleM9e9ecbEojvScL5zov3KFEoR1AWVFozb9WKO3iASg VjBWNY0pAUERaHr9ZraU+fbeJSTAGajKFcfoRKdl//e4GqxJmI/epZpJrVS1MIE3ekQ5 jZ4Df6VLPrQjk3CdT+gmXOdZOn6UnemwGRT/jUB9+rJrRYSh3U+vOlSM5GDl09F0YRpl NT01Y0EoRAzw3p+fmBby5uWp5dtAY5K1NSZgibJzNJql5JTYOKpVOUdyAdeUkxmS+Bow EVBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789993421; x=1790598221; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=9PtmaD+dFfANavdWfY8E3JvcpIeWj4J1LbV7u+lXUeA=; b=U4yFsUE25HgcqiDO89SRWf8FDhF3c3CHZWUBEzU2SBdVI1HeBIZctK2pQG26C9bI9d UI4WSyR9vcrBKN0E0SfpttALr07p+iuFXrOfNchtnkP+k7BIySdoUK61anIYzUNvRua+ sJvapukRqABA+nLU1X1K63vwzlpptfhAXLd1NzphliozNBjMhibcuxeHPxT0z6ivMQ3r ORqbOuMwr09EquZR07fBTReokhyuYw0chcLrrpDMUQz9USpX8mcH0pPw7av/RoGYU5l1 YvUIPCZkRfLhyOYVrPLNQU6vAX1twYghn+GjPDe8Ci4D2ceB/VRZLcQ+lqaL0uePTqXy R57A== X-Forwarded-Encrypted: i=1; AKwUvBwGGi+aQ8L3edFtsGlaVwvtQ3BujBOn9UbfIwqQUc1WtP+/YgP6dpEg4Q5GFc2SQFm0V+VNdKl9u9GjIQw=@vger.kernel.org X-Gm-Message-State: AFuF++kFKWbc3+V1QAwDBzAvcsByk3q8JmzNzy3oDTaQdJz23P0DxPyg BiaaqzxFPBJUDuaPHDT1+2ZpsuWRHW5H91b8QSH3jOQVgeZpdixwiI1U X-Gm-Gg: AYBFou12nw9hDtmskIOCPxbWDxToSC25WtBhsrnpp9PRkUN+INnIIw3Eej+9RPYP+IY xRiZYmsXIyZhRtNTpjq9IEHB/G1DyMKDP28kqYW3Yo3sWYrXKO2vEMBgVZKSOYdqPcGvaDhXEt4 WOAKRVe27a/2d4ONGuFFEpSLopkB7WX346YD8zpKXDPoqMTM+JFo2ufV08UAQYig9Nrvke03XG4 rPxcyQC6XpRK4c6u0WNFp2blAlVaMjFUqrXoOwbgfcxKx91u4oXh1Mdr8nlWW3H1HSb+GkHKhvj fhv9ebtoHDtUpL6h/46gRt7zmVvxI2zFVIEXVQivhxciMIcOPwjPShR4xwjdqexjSNrFXubfO+x jTh6hXHkjN0mHwXEBymkMkxP6xSexu58BRA39nVC2DCDFuGPsX7kt+eEwJPpmsQoJX1lGK8uq/6 e/qTMUmm9Abd1SpqBpqKtVpuF3kE1tCdtBd4d8XqKGDiaDDl6y4AeWhNxqGgn3OiRUh51PLp67K S7f+fmSY2Swv0vU X-Received: by 2002:a05:6402:3205:b0:6a9:ba2d:4752 with SMTP id 4fb4d7f45d1cf-6aa53cb300amr8619349a12.25.1789993421279; Mon, 21 Sep 2026 05:23:41 -0700 (PDT) Received: from SurHub.localdomain ([196.188.112.50]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6aa67b5eddcsm4228761a12.0.2026.09.21.05.23.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Sep 2026 05:23:40 -0700 (PDT) From: Abdifatah Suruur To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: alex@shazbot.org, eric.auger@redhat.com, smostafa@google.com, praan@google.com, ioana.ciornei@nxp.com, nipun.gupta@amd.com, nikhil.agarwal@amd.com Subject: [PATCH 1/7] vfio/platform: prevent read-only region mappings from becoming writable Date: Mon, 21 Sep 2026 15:23:28 +0300 Message-ID: <20260921122334.2099-2-suruurism@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921122334.2099-1-suruurism@gmail.com> References: <20260921122334.2099-1-suruurism@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vfio_platform_mmap() rejects writable mappings of regions without the WRITE flag, but leaves VM_MAYWRITE set. Userspace can map such a region read-only and then upgrade the mapping to writable with mprotect(). Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445), drm/panthor (CVE-2024-53071) and commit a5edadbae57e ("ptp: vmclock: prevent read-only mappings from becoming writable"). Note this is defensive hardening: no in-tree platform driver currently publishes a region without the WRITE flag. The guard costs nothing and keeps the mmap() interface honest if a read-only region ever appears. Fixes: fad4d5b1f042 ("vfio/platform: support MMAP of MMIO regions") Signed-off-by: Abdifatah Suruur Reviewed-by: Mostafa Saleh Reviewed-by: Eric Auger Reviewed-by: Pranjal Shrivastava --- drivers/vfio/platform/vfio_platform_common.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/pl= atform/vfio_platform_common.c index c72db5a99ebda..ab531318f170a 100644 --- a/drivers/vfio/platform/vfio_platform_common.c +++ b/drivers/vfio/platform/vfio_platform_common.c @@ -591,9 +591,13 @@ int vfio_platform_mmap(struct vfio_device *core_vdev, = struct vm_area_struct *vma && (vma->vm_flags & VM_READ)) return -EINVAL; - if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE) - && (vma->vm_flags & VM_WRITE)) - return -EINVAL; + /* Prevent read-only region mappings from being upgraded with mprotect() = */ + if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE)) { + if (vma->vm_flags & VM_WRITE) + return -EINVAL; + + vm_flags_clear(vma, VM_MAYWRITE); + } vma->vm_private_data =3D vdev; From nobody Thu Sep 24 18:40:04 2026 Received: from mail-ed2-f35.google.com (mail-ed2-f35.google.com [74.125.228.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78027496D5A for ; Mon, 21 Sep 2026 12:23:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.99 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993427; cv=none; b=MC9LVCNQfWCn6ocS7L18K0omZFkpYlanl4GheFm/Fgxc62Vb+wjPnRt7rR8HbP843/rYMNjZPR4XrLxePkoLf802KYpFu7m/3WtVAVVCRswVxrM73XBe5QDajvlaXrncCY7XyApr1iXjNR8iucEkwX1s4iJayi1cOjF5vpR3keg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993427; c=relaxed/simple; bh=AIdwN2utZ+S9OIGhkxgi5YqFtL0V+PJG7pH77YVnr4M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pOmvoTf77X5IGPU6+UoQAJs6yuy/QyNIO3y5J5AISnJR3grhgiZnc7Z3DKcIzLE10kaLlbOxEPu5Nn0GyJEfZhLGMOFQzXnB3iyk/XViaP7brUHEcV68Adz9l6FTyMx/vwpikVoJmrT0eAsJSoxt/zLBrd0GQrOnYDGUCXZ3z24= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=GVvYqyXV; arc=none smtp.client-ip=74.125.228.99 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="GVvYqyXV" Received: by mail-ed2-f35.google.com with SMTP id 4fb4d7f45d1cf-6a985e8fcddso3543666a12.3 for ; Mon, 21 Sep 2026 05:23:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789993423; x=1790598223; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KsqvDPr7iq6cd8ngK8PdM5xwS0CUZIiH+1Dv2KM9pss=; b=GVvYqyXVdKnyNG3psox8nXHi1oxOaoKiGyELuPLRUZ5k+fP0hfEgQ0JaC3vv15vXw5 OAeML8YahcZ15ioj4UqJCbVbBf09fGeGhE+ovyN+Y1dFFlxFrXUecG0u6MHU5/dQ8lJB FA2SwSivNt0oyR4JIcGp5RpJzGme8BAVq3J0OTGkeDWL2o/BisUJmHsuxqK8aP6OESxQ 3xDOOQ+UXp+zB+8nLHk7gVA5Ig8rOLAiyV1BDtT3eh6/cNvqeBx42DI98NuK4C4K20Tn N0PLxH2y+Gul8iiIhhDQwltgu67WMyEvNAXJcRwXjJfobeJHtH+8u5rqEKrFzuAmm3eL qs0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789993423; x=1790598223; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=KsqvDPr7iq6cd8ngK8PdM5xwS0CUZIiH+1Dv2KM9pss=; b=Q14WfGF0H0p6gTVFpDeCpe8CU68KPiDEkvEKniW9sRMaImAhYGDISKlMqqYFzUnRNW K4mnRd15Y+RGAySiL09kl9iZglq3xqB8YU3qmaqEGyHhA8SiUp1K01gTpDK49N2+E0d1 MoJFBGbFYXtKD6YF1xfpBAL8WuSi7voYrfa2QFYMSkc4DbyjBdb2jzl+EzHqPr9DCiUb lUhA64aGyuOOBu4hBRa7aObzWw/SFCmADcJSzbeKaBUYG+GzzCP6pgm+JZLImZB85TvS HjCHfExUMgrq+37MaaV9dqUGd06c6gRUVuqa5bjVvveY68Q5OP8SXYNgCMkOysgYKIkm BEew== X-Forwarded-Encrypted: i=1; AKwUvBy5wdijOqtLVA68mIzx9/sGgP4umxF8aDB4xsUlk6TfzDSDHiiFjR0TEw3L8TUZ4he9X5mQ7agdvYZLyk4=@vger.kernel.org X-Gm-Message-State: AFuF++ny1C3CPsZcw5Lsi6q+wq/8CN8aY0AxSl26mlJ7jGBNaNyeYm+J YcDhOyKMFybUF2T5PHtKKsa+GAD104dArZBGj/oVUYaBFgaFPIw9/Bgn X-Gm-Gg: AYBFou1nnJxMFVf1w6APUPMY+U7ATHA7YT9qsQJ0ZaAoVuNVsxccTkRatsan04X32pf M96Y/QWvFuniNCWaBAicvv6AvpaNo/PgcG4KUyVSQR9UboTSQ4WgbwypiCp8r/fOSxW1lS7qCjD d8u+9QS2brft68DtGQkzqQ2e2HYzah+U9yZbUlOemQPLEQ3ggLJsnWNRNeDdE6XeTEXjWIvfYVt Qn7ThTSNEcovTAh5zkE9IeRNYRZtCEpkOLHtTr1ydc3tRc6S6A0908YkpBr3/CN1WH+NvMz9B00 LEds65sEDkR9Q+3pAz8Xgcxs8UyiIAiIYbl2aUHC3lRohaTAfGvhMbx59kcO3NehEjzeot5sCKF JLMEmg74P1hEdGhkY1axx2ID4GXyhHhsoFlUHczR7vVKiNzMBU5gYKN5dQMdQV3DAfFN+kLZtc3 sKmW7EvfuPNlYCnxxQxXCw25q7jIJnvdo57MdyZYJvq0VBWaRNEELQdwOvN/Khp27IFRlupwG3E DHA1w== X-Received: by 2002:a05:6402:434c:b0:6a6:32f5:556f with SMTP id 4fb4d7f45d1cf-6aa562e21d2mr8202167a12.17.1789993423220; Mon, 21 Sep 2026 05:23:43 -0700 (PDT) Received: from SurHub.localdomain ([196.188.112.50]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6aa67b5eddcsm4228761a12.0.2026.09.21.05.23.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Sep 2026 05:23:42 -0700 (PDT) From: Abdifatah Suruur To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: alex@shazbot.org, eric.auger@redhat.com, smostafa@google.com, praan@google.com, ioana.ciornei@nxp.com, nipun.gupta@amd.com, nikhil.agarwal@amd.com Subject: [PATCH 2/7] vfio/fsl-mc: prevent read-only region mappings from becoming writable Date: Mon, 21 Sep 2026 15:23:29 +0300 Message-ID: <20260921122334.2099-3-suruurism@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921122334.2099-1-suruurism@gmail.com> References: <20260921122334.2099-1-suruurism@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vfio_fsl_mc_mmap() rejects writable mappings of regions without the WRITE flag, but leaves VM_MAYWRITE set. Userspace can map such a region read-only and then upgrade the mapping to writable with mprotect(). Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445), drm/panthor (CVE-2024-53071) and commit a5edadbae57e ("ptp: vmclock: prevent read-only mappings from becoming writable"). Note this is defensive hardening: the fsl-mc bus publishes all device regions with the WRITE flag set, so no device can currently reach the read-only path. The guard costs nothing and keeps the mmap() interface honest if a read-only region ever appears. Fixes: 67247289688d4 ("vfio/fsl-mc: Allow userspace to MMAP fsl-mc device M= MIO regions") Signed-off-by: Abdifatah Suruur Reviewed-by: Ioana Ciornei --- --- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c +++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c @@ -406,7 +406,11 @@ if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE) && (vma->vm_flags & VM_WRITE)) return -EINVAL; + /* Prevent read-only region mappings from being upgraded with mprotect() = */ + if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE)) + vm_flags_clear(vma, VM_MAYWRITE); + vma->vm_private_data =3D mc_dev; return vfio_fsl_mc_mmap_mmio(vdev->regions[index], vma); } From nobody Thu Sep 24 18:40:04 2026 Received: from mail-ed2-f12.google.com (mail-ed2-f12.google.com [74.125.228.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 15237499F17 for ; Mon, 21 Sep 2026 12:23:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.76 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993428; cv=none; b=abhyJx6WbmEg16AnGWufZTbV1VyTzhgHNSF4VfM8zul2/Fl4MLijZRF8gASoohV3M0QAMYzP7FWLnspI/q+ckZLdj9LjB/65VROICqSX6Uj7RKSa0Jnu0VPJIsqqvgrK0bew8MI3Gs2PyEhKj4sJixMwA9pFG8/RCf8VuCthoiM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993428; c=relaxed/simple; bh=KelE4SWm1+HYl0DpOC+bCl0jk0qcaELIIMi1khMiueE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VUIo4s9BBR4Gyw+bXSOZRa7tdeNXIFCDS3ktp3i61FD9+XwX40mmBd8xOuBxsA2IYWAt44z7e5lUj4z07kVz3YyklXwxzTrAl4F7FqS8iyoLx+GOcqXZIFTGP6Za15Y+LzF1On6hfsvDIwWzM5X3859eOsL+viqHBQoG9Yb1sfE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mCgPbx6w; arc=none smtp.client-ip=74.125.228.76 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mCgPbx6w" Received: by mail-ed2-f12.google.com with SMTP id 4fb4d7f45d1cf-6a605844571so3465733a12.3 for ; Mon, 21 Sep 2026 05:23:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789993425; x=1790598225; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EF+sKWuB3CWbGRd7nfbQrjAa992ig3a8RDVONCAqUWU=; b=mCgPbx6we7NYaWk5pZs/ewxGcndbQRWXDBQ4GRUZlYPBT1otTltQEbwWSrQh7Fo+9F AEu/twEsbZajkN7d4fuLkKYKoAbz83+UiYym4G+Dv6EU2svA4R8V93BKIL86WDaI7fck cCyTsGzDCwotzF/AqhMNnL5MNpKjmU+g0rvJfeyVWWKnkKvBzzeDzKCYTXyOeVotIjTR 1VGKu9Gf16veb00EoUQ40bOsjrktGwG1xa2SO04U54RIyp6UZ2eNHEWlfjwoaYoS3LmK XbD99Eddl8mxhOGJrw/F9QK7Ye2xT5lLTDBCQN7nxLbl6KW9TNJTGOFLa88wfhzyc+4F haBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789993425; x=1790598225; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=EF+sKWuB3CWbGRd7nfbQrjAa992ig3a8RDVONCAqUWU=; b=PcIroRAeFetKePRwaoj9suMMmPg83KqXpvWs4Nwfwgt9uWTHehpYOIrKmUn33serFn wphF+BdnGy/WGhzEHxl0Yq3kpJEav9fEAyF5ogJGMhzQu64b4pjZBFWq3I9GhRec4xG0 5Ck2D4RaJWxgVMBnXGQC7VS9SBIXEFLV47e8pNu36ANykqpgzU3p+1RFOZFT92lDZeYn RnG4uuUl4Lrc9w/4ZgYoRRbQIPHEyVITDtuxaoLS26awu/3ZuLS7dBDFzwjJ3VLfoQWn UknVXaOyubRWO8AdPGWzCLYxuohja0AePNl7IXThFmz9O3Cuw3QflELicQswSot1Gtad p0hw== X-Forwarded-Encrypted: i=1; AKwUvBzRG2uHDmUVn4Fhq6SFCCukGZ8o+eMTKvokarh3a8r/6dR+12Mx8nd8Kk7fLTrr8Z/g+h3F8k7XAw3ASYU=@vger.kernel.org X-Gm-Message-State: AFuF++m/Jz42h0Fr6Zxd0mpfMg3MqfjlYn848kC3OwGaoiHYxHbZJbv0 rqcN2pWXm+Xhuq1dfX4Xq/A7SUS2cgWLtmxi5mJqcfLczmgzFEIDTtHW X-Gm-Gg: AYBFou1K+/WaFzU3Lqb4l4KDz4RnEI2xoKrIMD+UNY0uK1a1kGdpqBqGlvjkFDsipvv Pq/AFNrL0Nq8uLs0AFO47Y9HlpfHzcZ4mo+YgYkfgdJ2WN/xqd3j1BJaztNrnb9kkyXX4nfVWKP 1AppETmzQNJuVSa5mUMITIDp0GUC9V+EzVecYypp8Bq0PAfVy+RFibRXLyQ6yXaz6bp1ElI/8f+ /qhFga5x+v68tyzkOIINSmCzxNFqmvNwiPEw3zvF6DzOXx5ZhfP/SoQzP6tjIgE/XxWpD4exU9I tWY7lmdMoZsEmLfyVOxzZb2jT0aAvel1m8F6orvbAz+RKyyvuKT2PIcbyhpmhoQaOxxJBOWrGuM KOwzpp1bEe73EiT74lBNbMQ2gnEsUs4PMIO/mRxkNe8iDs2hbc7wLy2o8VLwIRlw4Ns6zRTIBTQ hwPwqh0+S5q9rSkrIj0X73HjRr72uEXJONb5ayS0xW3SFS2kAgLWjAE7a0RraVf0KznT4UWEbZd TX+Uw== X-Received: by 2002:a05:6402:4018:b0:6aa:7fb:7696 with SMTP id 4fb4d7f45d1cf-6aa545f8024mr8446773a12.2.1789993425204; Mon, 21 Sep 2026 05:23:45 -0700 (PDT) Received: from SurHub.localdomain ([196.188.112.50]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6aa67b5eddcsm4228761a12.0.2026.09.21.05.23.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Sep 2026 05:23:44 -0700 (PDT) From: Abdifatah Suruur To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: alex@shazbot.org, eric.auger@redhat.com, smostafa@google.com, praan@google.com, ioana.ciornei@nxp.com, nipun.gupta@amd.com, nikhil.agarwal@amd.com Subject: [PATCH 3/7] vfio/cdx: prevent read-only region mappings from becoming writable Date: Mon, 21 Sep 2026 15:23:30 +0300 Message-ID: <20260921122334.2099-4-suruurism@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921122334.2099-1-suruurism@gmail.com> References: <20260921122334.2099-1-suruurism@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vfio_cdx_mmap() rejects writable mappings of regions without the WRITE flag, but leaves VM_MAYWRITE set. Userspace can map such a region read-only and then upgrade the mapping to writable with mprotect(), writing to MMIO regions the device marks read-only. Clear VM_MAYWRITE for regions without the WRITE flag, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445), drm/panthor (CVE-2024-53071) and commit a5edadbae57e ("ptp: vmclock: prevent read-only mappings from becoming writable"). Note this is defensive hardening: no in-tree cdx device currently publishes a region without the WRITE flag. The guard costs nothing and keeps the mmap() interface honest if a read-only region ever appears. Fixes: 234489ac56130 ("vfio/cdx: add support for CDX bus") Signed-off-by: Abdifatah Suruur --- --- a/drivers/vfio/cdx/main.c +++ b/drivers/vfio/cdx/main.c @@ -284,5 +284,9 @@ if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE) && (vma->vm_flags & VM_WRITE)) return -EPERM; + /* Prevent read-only region mappings from being upgraded with mprotect() = */ + if (!(vdev->regions[index].flags & VFIO_REGION_INFO_FLAG_WRITE)) + vm_flags_clear(vma, VM_MAYWRITE); + return vfio_cdx_mmap_mmio(vdev->regions[index], vma); } From nobody Thu Sep 24 18:40:04 2026 Received: from mail-ed2-f12.google.com (mail-ed2-f12.google.com [74.125.228.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0AE7C49A3CB for ; Mon, 21 Sep 2026 12:23:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.76 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993430; cv=none; b=GKWk+dzxcgpTslTANAy64Jrzvk4eAZYZ+f09FpOvjjuyAEIWaxoOsPBaMIPcngOt7/oo1bY4xytt9wQzIdCCa+KNq4KAnbclXAXoZajAs1WNP1VFIDpaAapnX5PUGOu4Xwb0hkmyGvf8ndcD93PwI0+XtJJ+t+7Au3RPLJNpoDs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993430; c=relaxed/simple; bh=BIXUR1k4TCtztN0bdRJqSgQN8mkGdqjNwSs9hVeWO2w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Il+cV9akg7nCeqT7vpWNpTfBchj6jm7eMIUYvt+NQ/gOhsGHMFSEXbfHmm/hBvMgz1z6AwXib9vjSTC74OJUXppFC6f6t3ZRtftgOAT0f9hKhqqqdf1uPs1SBHhrX1/ZWpjJJ6dq4eMVftngmcjnN5zD+SKE1fcCG3iXfL4k+Hw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kwR68MuW; arc=none smtp.client-ip=74.125.228.76 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kwR68MuW" Received: by mail-ed2-f12.google.com with SMTP id 4fb4d7f45d1cf-6a60590a85cso5410904a12.0 for ; Mon, 21 Sep 2026 05:23:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789993427; x=1790598227; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=mCdqlEsnXoPna4s4ma5cQkM3Ci8W1h/73sFhSd4uQE8=; b=kwR68MuWNifPf09vw+NNwsAErmy5MI9Sg7PzFSL3rTTnlhir9oMtZHBtKbJaB44Rck G6qgyZLtLsLSWHX5Py+jG9zA5whn31kjZ33Pejs/AZau+pAx7YbQ8bL9Kmwbi/6xIco/ JRNmomF1IGlLAE+NIcan7IGyYv2T/zvKDoNV+qpWcoDwIzs1hRSIhphCHnNAbT0/Ysdh HxzZZlX98MIH28yndWSUclA/Cr8kRxR4VYy9G6dAJqlc1CMtfegsLBiuASHO1675nDZB dkMxnKwSiHyUa5PM9Ou0FBkPYxjY8rPpgJo8O87R1vVhfz/wCv6CULiTsseiRGaBPSwe WFeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789993427; x=1790598227; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=mCdqlEsnXoPna4s4ma5cQkM3Ci8W1h/73sFhSd4uQE8=; b=Pbt5cPyZG/3m2kXiGe7P+gJ0ZLYKklnQBNpA2YcUHT3Rq2aF0j616woo7S4P36I1Td 7zMyUd6xqFERo7WOQIsdwZFFiUvfUEe1AOVI5ZH1ds6DhVDH+1vaoL7BecpiGyHpbcL/ RKSsE61+C62Ocnl0Hzni/cTB6fY0OstCdZd9T7YUqrC5OQzRep/Hz1N+KHRW8wY1iGfb NppWUGSY0K++8S3Apq0V0mzFFEE/Wsmf6kLix0JVyu3wvUqWOV9TpyVAXLM0AB9oG2Ns LifhhaF3BXKSjnZhjVz3BHSyzagEsA3BTABfnhUNAx4PQNgp8+51fK6V/3mqf4AyFF/+ RcCw== X-Forwarded-Encrypted: i=1; AKwUvBxtkD9Q67gvd6pePTzj1YSkUCWpTrRHNlVPwQj9Q2KJRWgTCj0m69Vu1ulbPQwIJDSZMkNG/j9qUTWDLIE=@vger.kernel.org X-Gm-Message-State: AFuF++kfIliSjzJq/JA5hldjH47kbiFqlly4MVMmdzWyN44xLdc18w52 R2okU20Q9RZj2YSdergxnzOEmD944Z+Tf4/hVXM4HO+Pyk4d/dg6dMWR X-Gm-Gg: AYBFou3igFR6eXR30MHb3e7TMClJ85f61OoFq1KUW0sapRYZsHBGziaaZarFPFwk0jG HkWbCRtTlTYhLEgf8ODhKjkRMzZKDcpa0v38pUuI1jSZvMi+6qnme3mQFf5J6pJhzQL9PC6Zvns PPn5qe8Eksw6z8FS8/QCd3KqAdrK/wbZLOwtTsSdPRMfKTPn94N52clqZcoG+EN2E5Q1v/NdXpp 2A2/+YQDIZNEZP96vVJ5FKMcyJbGU+/swYoK9bONMDsXZm1NuMzn61jQLrNzNeLmSSBLe6eLGQt llkrEOJlsnCzvFyp0rHhrxzlI9pRK6suUCcPswKs8io9LVU4GNkq5OwFHAVU2qES4FxNFcigSw6 OR01s6IeSZWt5pTXv5UUklPk8zkYAaXNIhxwO2Ql8kM6FN1cZWr3zQhUwiggtRNJY4nntC69GYP plSWCuqwI5ETOz5O9ok1XK6pHNayrS+bAIPqqYCykgGWCaZlTq3XBs2ILsPbKdA0SPlHzkHz7oj Pd0hA== X-Received: by 2002:a05:6402:1f11:b0:6a9:9894:e4b4 with SMTP id 4fb4d7f45d1cf-6aa5799f094mr8220567a12.34.1789993427184; Mon, 21 Sep 2026 05:23:47 -0700 (PDT) Received: from SurHub.localdomain ([196.188.112.50]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6aa67b5eddcsm4228761a12.0.2026.09.21.05.23.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Sep 2026 05:23:46 -0700 (PDT) From: Abdifatah Suruur To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: alex@shazbot.org, eric.auger@redhat.com, smostafa@google.com, praan@google.com, ioana.ciornei@nxp.com, nipun.gupta@amd.com, nikhil.agarwal@amd.com Subject: [PATCH 4/7] vfio/platform: keep logical vm_pgoff in MMIO region mmap Date: Mon, 21 Sep 2026 15:23:31 +0300 Message-ID: <20260921122334.2099-5-suruurism@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921122334.2099-1-suruurism@gmail.com> References: <20260921122334.2099-1-suruurism@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vfio_platform_mmap_mmio() overwrites vma->vm_pgoff with the physical frame number of the MMIO region and passes it to remap_pfn_range(). The VMA is inserted into the device file's mapping->i_mmap interval tree keyed by vm_pgoff, which VFIO expects to be the logical file offset: the core links every device mmap to the device inode's i_mapping precisely so that unmap_mapping_range() can revoke all mappings associated with a device (see vfio_device_cdev_open()). With a raw PFN in vm_pgoff the interval tree entry lands in the wrong coordinate space and unmap_mapping_range() cannot find the VMA, leaving stale MMIO mappings behind any revocation attempt. Keep vm_pgoff in the logical VFIO offset space, as vfio-pci does, and pass the physical PFN to remap_pfn_range() explicitly. This is defensive hygiene: none of vfio-platform, vfio/fsl-mc and vfio/cdx call unmap_mapping_range() today, so no reachable stale-mapping issue exists. Keeping vm_pgoff logical preserves the VFIO core contract for any future revocation path. Signed-off-by: Abdifatah Suruur --- --- a/drivers/vfio/platform/vfio_platform_common.c +++ b/drivers/vfio/platform/vfio_platform_common.c @@ -561,6 +561,5 @@ vma->vm_page_prot =3D pgprot_noncached(vma->vm_page_prot); - vma->vm_pgoff =3D (region.addr >> PAGE_SHIFT) + pgoff; - - return remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, + return remap_pfn_range(vma, vma->vm_start, + (region.addr >> PAGE_SHIFT) + pgoff, req_len, vma->vm_page_prot); } From nobody Thu Sep 24 18:40:04 2026 Received: from mail-ed2-f12.google.com (mail-ed2-f12.google.com [74.125.228.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 37DD949B5A7 for ; Mon, 21 Sep 2026 12:23:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.76 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993434; cv=none; b=M2lli45e4byaEsvqdi0RGNBx0N41ekxXkiL3x6NFnr554XrNdBBuyrY+pHaXMMak+Sdm8GrPlEEayW07v1Qa4uItC0VX28E4X5SRvYzD6ZRHPqqYWbh+VPXRK8QvmyXQ78FGXJXSoj2Akv0jYHx0KSzepRBbV02b4o701oD+GMw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993434; c=relaxed/simple; bh=lHBCLvD9CFWwUxarJDk4h3SsAeacuQKNyNWI8I1jmRM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jDRb6d9WnyW9N7ht7IQRfVLLdUKJX3YoUV86dH0pZ1uHpXD8pD/DxyzqgTgJuFEUfDQvuB9JKW2o/n6iI+V9XE7BfLEW/rwEv7Yts1yZY1vq07LrEFsUbxU8eo1w9idYuxKKsh4uh7xLzJvjFU4BtGv9nWJ0uY6m0orhq+RtLqk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=MO/WfLh/; arc=none smtp.client-ip=74.125.228.76 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MO/WfLh/" Received: by mail-ed2-f12.google.com with SMTP id 4fb4d7f45d1cf-6a8038a9f10so4012172a12.1 for ; Mon, 21 Sep 2026 05:23:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789993430; x=1790598230; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0DZFsAd1gCt8HtlyNvooZMCa7qVbQcWPBgvKmJUoZ8A=; b=MO/WfLh/O5Sw2ACQyyAwmvsdCMEMYB5jKDO/HT+hz+8YG+y/r96MqBDtwQMGjreJyP 1TRWCjJmz3C2fJb/D2WJcf92s4tjY1ox7SqS5pZGnNJH92iqKD9r6AjIqi/MYSOOAfUm guXGqjIrDYFTgw2V+3vd2PgeZp0WIMcSy/zouI3PXkzGtspcf40/U+4qa7bAglg16SZK TRfeqb8s84dKzz9uU6r3ZiUF0Vs9W+YBBPSO2VZZYmhxblc1YeRuR0b3OG4rkMqTeocx wqguDOossWfI/4hsEcrzwyoWfoTXyJfiW5JkuH5PAYd5l0JCAWOeC/5sr29+XPQUYxOZ 79uQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789993430; x=1790598230; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=0DZFsAd1gCt8HtlyNvooZMCa7qVbQcWPBgvKmJUoZ8A=; b=2P/rUJdjiX6EybFJiavAQAKI+mgnnr1PQeozNlKp8lsvFu7d/nuYF2dKbgELwQyNaj 55MH0P0+1pYPceFpjlwwzBbzCh8ATVncbcwje2bprOoTo15Cg7pBy8PfF/wLIQtFyIeJ RLmcPOQCsafybHU4YNxZ88QVsxCOpt0jT8wAa1HFKTLskpimL9CF91ecBvzZic7Z+FSV I8rrs1y5YiBhT9+LKQ5mi80AP6SRSW4mnXcL2Y7poIN6zhI6oVaO0nfSjIm3O2W91Swe NZkP2+VzjznWBtzQCVPW8Z5340xuSc2+jJkD2w+XjvuaCh6KlvRfKnpUMl40M9AVqFDs KYQA== X-Forwarded-Encrypted: i=1; AKwUvBxAngXjWmngZ/kdkM/Rvi6U8faVsLutI5wecC2a8rhyK1bC/wNx7Ck014HymI5X4DMtE3faceY+l/4Yzg8=@vger.kernel.org X-Gm-Message-State: AFuF++m4MN5JZLmCQaLo39XJpfKzWadiTDXFD7fvo/cYTIbY4bpKlirs qCpPxFDfYouPp3skP4lrGFps+9pcaCNKPtdgz8ztazxiy5aMkOEUDnim X-Gm-Gg: AYBFou0ZuvufpLqCdnuTIS50Zoh9nzqehQKmzJJgBBRS7PxxjTudOQCjdFdxPydfF44 jqVk6FiR33ZZdWIP+VwRghhA9fEho4KqavaWi8/Pyo2l3VxSbYlR60PLErd5EZeAGspTU9eUJ5O yRlK5A58qEfGnkK3IPN3Bb/X5ycik1S0wnlRR2cNJfrvunCLnxuM7XptlL/2zOXBFalChQKqMTU P5fMONSnAKhScD3MnRhKW2cicJIfq6Xuvh1QJjvMsvoMn1XLK2eIF0FJRKknh0Aod191A5MY3Wl fGPjgwQO5REErth4L7sn6dH4SBq1stALFbbOoUblswtGcclC7lQx3/mxs48YFxAVtKKFZdbjnda 1KxRctXobsbRhBDbf4pjOAL9+RU97mKxK2MvRcnt9uL7orNS2SkhQznQLI74pFPREafWpQQ/tJK C30ZY9rRtovA/i28NNVq/E93bSIJfckcPhC0Y9mvj5iiVTblVwsCYuEeHmaM6BaOPWAZyeOFcBg LMrdA== X-Received: by 2002:a05:6402:21d3:b0:6a7:ee56:6156 with SMTP id 4fb4d7f45d1cf-6aa5637bd3cmr7056944a12.24.1789993430163; Mon, 21 Sep 2026 05:23:50 -0700 (PDT) Received: from SurHub.localdomain ([196.188.112.50]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6aa67b5eddcsm4228761a12.0.2026.09.21.05.23.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Sep 2026 05:23:49 -0700 (PDT) From: Abdifatah Suruur To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: alex@shazbot.org, eric.auger@redhat.com, smostafa@google.com, praan@google.com, ioana.ciornei@nxp.com, nipun.gupta@amd.com, nikhil.agarwal@amd.com Subject: [PATCH 5/7] vfio/fsl-mc: keep logical vm_pgoff in MMIO region mmap Date: Mon, 21 Sep 2026 15:23:32 +0300 Message-ID: <20260921122334.2099-6-suruurism@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921122334.2099-1-suruurism@gmail.com> References: <20260921122334.2099-1-suruurism@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vfio_fsl_mc_mmap_mmio() overwrites vma->vm_pgoff with the physical frame number of the MMIO region and passes it to remap_pfn_range(). The VMA is inserted into the device file's mapping->i_mmap interval tree keyed by vm_pgoff, which VFIO expects to be the logical file offset: the core links every device mmap to the device inode's i_mapping precisely so that unmap_mapping_range() can revoke all mappings associated with a device (see vfio_device_cdev_open()). With a raw PFN in vm_pgoff the interval tree entry lands in the wrong coordinate space and unmap_mapping_range() cannot find the VMA, leaving stale MMIO mappings behind any revocation attempt. Keep vm_pgoff in the logical VFIO offset space, as vfio-pci does, and pass the physical PFN to remap_pfn_range() explicitly. This is defensive hygiene: none of vfio-platform, vfio/fsl-mc and vfio/cdx call unmap_mapping_range() today, so no reachable stale-mapping issue exists. Keeping vm_pgoff logical preserves the VFIO core contract for any future revocation path. Signed-off-by: Abdifatah Suruur Reviewed-by: Ioana Ciornei --- --- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c +++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c @@ -369,8 +369,7 @@ if (!region_cacheable) vma->vm_page_prot =3D pgprot_noncached(vma->vm_page_prot); - vma->vm_pgoff =3D (region.addr >> PAGE_SHIFT) + pgoff; - - return remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, + return remap_pfn_range(vma, vma->vm_start, + (region.addr >> PAGE_SHIFT) + pgoff, size, vma->vm_page_prot); } From nobody Thu Sep 24 18:40:04 2026 Received: from mail-ed2-f35.google.com (mail-ed2-f35.google.com [74.125.228.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5FCF049503F for ; Mon, 21 Sep 2026 12:23:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.99 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993436; cv=none; b=nDeHqZZ9zCGoQkGP78hswBDPYgrDk07+YIP/xn67K8jhxVVu3yJSAiTqFczhuDkHk2kJaDK9KFwLA9sQ03yHTmwt0MbG8WAnKMBZP3FX+roqJ3rsYTs1RyovgdQbTnMavTaLVEuFmgM6CtXuLad05sNUmoSpOEdbnh1LsIYsHVo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993436; c=relaxed/simple; bh=T3FwPjlvnscQHR8jx5/rkQBZvadbHM0UeyhMOsIsDU0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BGqjO8zh5FagPlOOKDCjMS606cN2+fQMTCJ491aLwKtLj9y4fgjNbnMYspGrQr6o/gLGjnS512AewkKaC4nYjrDmJxX/nYMAIL1IvlJUhzQ56yhqnxmrIbaw866Ujw564OzMaX8lCTidvX5sKmNZV0qXrWt/In+Dw7MBxhUfAjI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Amhr/CNQ; arc=none smtp.client-ip=74.125.228.99 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Amhr/CNQ" Received: by mail-ed2-f35.google.com with SMTP id 4fb4d7f45d1cf-6a9ab2a135dso3830016a12.1 for ; Mon, 21 Sep 2026 05:23:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789993432; x=1790598232; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JE3HCQjPuIhn0lobZGGXaWXmcnd2kPkISnJT/NhU4vk=; b=Amhr/CNQGrSpEEWqX041ZVx/vyi1+48y2+h2e1kp1NDJjnlO8zbiFcy/jUrzdHQ93l dZCjK6jfoCM6dF9+LGmh1e7l14RFhj+lLd71q7Z6EhhUY5rg6JiyujkCM1DfGv2tqtPY dYp6u/RIDl4g8PXX8PE7rEvUT/mYl/+1b0+f7iyIinN/ddbvFsInY1I8y58qdfQuvl/K 54HZEygdF4Iqzr/wJRg2/Rs0uhgHbykR96bKLnlCxqHSK6U1u+Lpz4kYUpmo30P8e8JK WwU1+QWeSPBbPXRdAzoignh+BD55ldtyOrcn8LCnS2xgbrmIv0TeZKGnvXkk8FogxjBZ O2Ew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789993432; x=1790598232; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=JE3HCQjPuIhn0lobZGGXaWXmcnd2kPkISnJT/NhU4vk=; b=Ph0b0oZmo2Rj5XBiFjlX3RzIrz0eqwGkNzAb477LTrdIgLQwumwq/P0Gb0i9qkw9A0 t2CHSayCT85/28w1a4WNSMvrRtA3nMwUxxSOFNO7sSsuvlwjIVvvgdoYccroxdB1Fwwo yu4ZqnM9eor17kXpzQtR8a0L0La4ipYyr0gkLVB5uet0BZ8EVWiLhboBnfJqj/QUZdJ9 qUoQOTt+CwvAo761HRw26/6sLTzFQYozEBrGk6XvV/vu76a/jzzyY4IFvyU94OSoxA5+ /if39BJTalEXVy2qN3bTojXuI55Nqpuv9QJd3r3ryTqDGrlvVt81Y9qf2j8B9+pbP3i+ K9tA== X-Forwarded-Encrypted: i=1; AKwUvBzQ0XxYLQnT9mf4WaHvxkRK4CAQC5+qPmz/9VzWVywYhkgv54vhO22/IeXkDXH/z4S4nQqzPoSllqfDCSI=@vger.kernel.org X-Gm-Message-State: AFuF++nYyFZi1aj/9YqMG4mTaKnHQWekec9ML3uDmxMc2nzhiegtu9aK 2mgFP9DfL7tNHhzpxA8Jz+K5XpQvYTcMMhML/E0zrrLV86VQpPjJ4yf4 X-Gm-Gg: AYBFou14Tffmh/ZNiQLPRue2knLXgebJo/2pnbmCgAwvSpcr79aX0KSGi/smSHyvmPv wgBfOiVBue9kmMrMkRTEOsymZDUcIPxvouBCtelmJ3BkT2Sy264m/i8q00sLh5hDETj9pFtrDi4 L6L4iOWzxcEvuz3gXm2VcWedqqRUUl+QIESb4uQbf1MvtGJT9Vzir3xSqJE6hYE9yHbSdJTTh0i MbwSRepaLP4Kct8duYeEHLmPVSSMuwX9mlSVyI+njZ/TurD/2UXwKn17y5nXO4k6CiDLzIlhmys 5N9/rqfpoQkIMerA8RpbQ7i1nrP3rNlQ18Vh5Po6oZlZqxVX8J1nHZEIlh6qLBjZYsDSNwlzAQG cPKxGawiKdnl+jiriyxo810TPSL3JHj6gG+upuZpuQo7sB+YYhvJWpu+q+H375i0abwGqjMawcl v5wxnZTInmkZ2eJZsE80c256VhEDfU3jhVYsZtru/wp9/ZTs/qcZqXSvIOCifK8WwazOJed9z/0 TEUJA== X-Received: by 2002:a05:6402:52c3:b0:6a9:cae9:471 with SMTP id 4fb4d7f45d1cf-6aa5478b9dcmr7776900a12.21.1789993432123; Mon, 21 Sep 2026 05:23:52 -0700 (PDT) Received: from SurHub.localdomain ([196.188.112.50]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6aa67b5eddcsm4228761a12.0.2026.09.21.05.23.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Sep 2026 05:23:51 -0700 (PDT) From: Abdifatah Suruur To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: alex@shazbot.org, eric.auger@redhat.com, smostafa@google.com, praan@google.com, ioana.ciornei@nxp.com, nipun.gupta@amd.com, nikhil.agarwal@amd.com Subject: [PATCH 6/7] vfio/cdx: keep logical vm_pgoff in MMIO region mmap Date: Mon, 21 Sep 2026 15:23:33 +0300 Message-ID: <20260921122334.2099-7-suruurism@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921122334.2099-1-suruurism@gmail.com> References: <20260921122334.2099-1-suruurism@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vfio_cdx_mmap_mmio() overwrites vma->vm_pgoff with the physical frame number of the MMIO region and passes it to io_remap_pfn_range(). The VMA is inserted into the device file's mapping->i_mmap interval tree keyed by vm_pgoff, which VFIO expects to be the logical file offset: the core links every device mmap to the device inode's i_mapping precisely so that unmap_mapping_range() can revoke all mappings associated with a device (see vfio_device_cdev_open()). With a raw PFN in vm_pgoff the interval tree entry lands in the wrong coordinate space and unmap_mapping_range() cannot find the VMA, leaving stale MMIO mappings behind any revocation attempt. Keep vm_pgoff in the logical VFIO offset space, as vfio-pci does, and pass the physical PFN to io_remap_pfn_range() explicitly. This is defensive hygiene: none of vfio-platform, vfio/fsl-mc and vfio/cdx call unmap_mapping_range() today, so no reachable stale-mapping issue exists. Keeping vm_pgoff logical preserves the VFIO core contract for any future revocation path. Signed-off-by: Abdifatah Suruur --- --- a/drivers/vfio/cdx/main.c +++ b/drivers/vfio/cdx/main.c @@ -257,6 +257,6 @@ - vma->vm_pgoff =3D (region.addr >> PAGE_SHIFT) + pgoff; vma->vm_page_prot =3D pgprot_device(vma->vm_page_prot); - return io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, + return io_remap_pfn_range(vma, vma->vm_start, + (region.addr >> PAGE_SHIFT) + pgoff, size, vma->vm_page_prot); } From nobody Thu Sep 24 18:40:04 2026 Received: from mail-ed2-f12.google.com (mail-ed2-f12.google.com [74.125.228.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A81FD49B5D8 for ; Mon, 21 Sep 2026 12:23:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.76 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993438; cv=none; b=tZpIRdLM1nGA2Z3yB3q0h+8zOr/xjTm0y+XcI7EJsAaFAzM8mF4j1qFkN5vlm4M7guzHhMIWtfxSkQ+SWo6qN/WZQTTWaumhuzwABpKg/zhJ/iLsIGryfxp7xPLgqSl3C9zKZ54x7dIn832MRc4ZLkqQpj8T1zu/Sc36sYPgSdk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789993438; c=relaxed/simple; bh=d0Pu1ilCGL9vvnrLmpOv5p3mO1EXNOEK6StG7zB1nxo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=N6hfklCBksASPrDXOOr3Nlos8jqa7LSgQX+S7yodDZtJcQON+3BahsTMVOt1y573hDnwYIbuKbCNZ1uoTxT2Vv9qPGYrEocYtyB9PBkm40zHI2Ya8Ptnbfk9KQWAHrweCqk75yXHh3gMnX9LGOv45tePL8rmeMTGozhKTFUk07o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=gXpEEn8r; arc=none smtp.client-ip=74.125.228.76 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="gXpEEn8r" Received: by mail-ed2-f12.google.com with SMTP id 4fb4d7f45d1cf-6a9a2b95b72so4628992a12.2 for ; Mon, 21 Sep 2026 05:23:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789993434; x=1790598234; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=yVmp8Yn2ZqAd40ufyn15a/l8ROXyGaSQFj5xPJK5IVE=; b=gXpEEn8rRNYPRn+XfHK/fG4sTzoa2B3Us6LYka+CBpL3E9PmW85myaeSY1EUB5dMBC QEKTLAtC8xPzpjKkY7H/keaGieMQTG+0J+xETxU1UiunS5QxQRnQ3+2kmqK3+5WoAKgR cEGmZLvxof7PPdIR/fkhy0IJP2ljAiC2nMItJAg0HxXW4+Av0atrRA/OESSTjabuAa91 2ER+Yo+ebtZpzzViZOTyNDw1FKo4AE0kEcVLUEhOyxIz3DDyQw6zu5EPODy56EvaUBWq SEAMEzLaAFPTuiZ2z+8G2u8Cy9u4TE3NSiAbeNH0n5plKu3iKmcu3r+LmtJ05EVBcqgB tBdg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789993434; x=1790598234; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=yVmp8Yn2ZqAd40ufyn15a/l8ROXyGaSQFj5xPJK5IVE=; b=sJXJDnNSoQ6QPQkPeWf7PwCewI0eNAd1j6HVJELwriL1uVWqW4ohjCEAt2Zw6j2ohP 72+zZ07ROWtTtxSwWUydAnm7eUAZTGn/XL1qtyNV9O0neffZVHV0EqqA66YhQNMSf2IT kshZ22Rd1iv4zknTIsPNzK69WhQQmkCYiotFR0AMAVP8jl8fQqUvTiYs5t1u2CD3qI2b oHR1o3DaI80Xq7OPkFKO8L0ehB3JxBc+Mf0Ac/BTRYLtiabRfo/JZambkFKx/UFluSsZ G7V13vjC8f7KdaxcO3qyJy09p1FYd7Okb2pRotRlU0Iqt0yQ9DYDsGHgI6TiRSplcuMN I3gg== X-Forwarded-Encrypted: i=1; AKwUvBwopxSOSc/lJNHuEUS5HezrhFN1PHfO+E1nTzXm6fIc8LqYbrrOncbqplZitdsIsHAlb197KiCJTs3oySg=@vger.kernel.org X-Gm-Message-State: AFuF++mPvG1HGD4Hnp/6morFQtdLj/Z0HlC/lCQALzdelT81FAqsTMej oikwFWaB9G/FyIw7VfEsqIvXoTQVejU+F52iAmmNiwwjLcLbRHg/txOZ X-Gm-Gg: AYBFou2LczxicnYpkHWDeRgdKf/fHBu6cu4DylSt6hDlBPhYQ1wqaO8C0FxBG4zr0XM NKwiRU7o6z5v851r3zltfKvKo0fdIdujzcI3VQMBvqhi/Ss5e1L76jZ7gI0IR0o/0ZCTGSUfj0i 5n1OKafxSuhsdAA76DzEcwpSU5jCOF7JShKmUAAx6VgaDiMjz6TA7uhSwU11MjARDuwlqdFSdco t3hZY3Fj6wZ0E4UCyrjZ+mOhK53YKEG72pusXXB3yY5xKYq+RwWtaieejYuf8jOixpn3AyBb4Y/ a8rEGEgzp+e8+Imxtq7amCdChs5lLfmjvzQvqjoiSfoLMOA+NIEkjOHAyiD1YY5e/XuYNQpHxqh iuoRd4L4NIH8vYusJUgULbENuPhqcy1wY6PaiUHHx+4rtIRzq1tMa7t66YKcUwCEr+f1E/wTDLN Nn6BK+ZfCZpRDRMHLkbXu1AibR130syNshncdgDw9BFSGdLrUh6BjM2U+60SELYiCNTtwDdfLRD E6JTg== X-Received: by 2002:a05:6402:3785:b0:6a7:ee56:814d with SMTP id 4fb4d7f45d1cf-6aa5798162fmr8755777a12.27.1789993434148; Mon, 21 Sep 2026 05:23:54 -0700 (PDT) Received: from SurHub.localdomain ([196.188.112.50]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6aa67b5eddcsm4228761a12.0.2026.09.21.05.23.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Sep 2026 05:23:53 -0700 (PDT) From: Abdifatah Suruur To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: alex@shazbot.org, eric.auger@redhat.com, smostafa@google.com, praan@google.com, ioana.ciornei@nxp.com, nipun.gupta@amd.com, nikhil.agarwal@amd.com Subject: [PATCH 7/7] vfio/cdx: reject non-shared MMIO mmaps Date: Mon, 21 Sep 2026 15:23:34 +0300 Message-ID: <20260921122334.2099-8-suruurism@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921122334.2099-1-suruurism@gmail.com> References: <20260921122334.2099-1-suruurism@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vfio_cdx_mmap() accepts MAP_PRIVATE mappings. A non-shared mapping with VM_MAYWRITE is a COW mapping, and remap_pfn_range()'s COW special case in get_remap_pgoff() then overwrites vma->vm_pgoff with the physical frame number: if (is_cow) { if (addr !=3D vm_start || end !=3D vm_end) return -EINVAL; *vm_pgoff_p =3D pfn; } The VMA is inserted into the device file's mapping->i_mmap interval tree keyed by vm_pgoff, which VFIO expects to be the logical file offset: the core links every device mmap to the device inode's i_mapping precisely so that unmap_mapping_range() can revoke all mappings associated with a device (see vfio_device_cdev_open()). A raw PFN in vm_pgoff lands the interval tree entry in the wrong coordinate space, so unmap_mapping_range() cannot find the VMA and a stale MMIO mapping survives any revocation attempt. Without this check, a MAP_PRIVATE mapping reintroduces that corruption even with the logical-vm_pgoff fix in place. Require VM_SHARED as vfio-pci, vfio/fsl-mc and vfio/platform already do. This is defensive hygiene: vfio-cdx does not call unmap_mapping_range() today, so no reachable stale-mapping issue exists. Signed-off-by: Abdifatah Suruur --- diff --git a/drivers/vfio/cdx/main.c b/drivers/vfio/cdx/main.c index b31ed4be7bdc1..6d208db0896d6 100644 --- a/drivers/vfio/cdx/main.c +++ b/drivers/vfio/cdx/main.c @@ -271,6 +271,9 @@ static int vfio_cdx_mmap(struct vfio_device *core_vdev, index =3D vma->vm_pgoff >> (VFIO_CDX_OFFSET_SHIFT - PAGE_SHIFT); + if (!(vma->vm_flags & VM_SHARED)) + return -EINVAL; + if (index >=3D cdx_dev->res_count) return -EINVAL;