ptp: vmclock: prevent read-only mappings from becoming writable

commit a5edadbae57e2298a56cf7a4e774a027905a331f upstream.

vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock
ABI page with -EROFS, but leaves VM_MAYWRITE set.  Userspace can map the
page read-only and then upgrade it to writable with mprotect(), after
which the guest can corrupt the host-written timekeeping data (sequence
counter, UTC time, TSC offset) that the vmclock ABI defines as read-only.

Clear VM_MAYWRITE on the read-only path so the mapping cannot be
upgraded, as i915 does for its read-only objects and as fixed in drm/vc4
(CVE-2026-68445) and drm/panthor (CVE-2024-53071).

Cc: stable@vger.kernel.org
Fixes: 205032724226 ("ptp: Add support for the AMZNC10C 'vmclock' device")
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Link: https://patch.msgid.link/20260813174707.14809-1-suruurism@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/ptp/ptp_vmclock.c b/drivers/ptp/ptp_vmclock.c
index cbbfc494680c708052ffc0de9ba4f4eec510373a..83114695dbb590474a8406667d1174283bfc1e76 100644 (file)
--- a/drivers/ptp/ptp_vmclock.c
+++ b/drivers/ptp/ptp_vmclock.c
@@ -365,6 +365,12 @@ static int vmclock_miscdev_mmap(struct file *fp, struct vm_area_struct *vma)
        if ((vma->vm_flags & (VM_READ|VM_WRITE)) != VM_READ)
                return -EROFS;
 
+       /*
+        * Restrict the read-only mapping so it cannot be upgraded to
+        * writable later with mprotect().
+        */
+       vm_flags_clear(vma, VM_MAYWRITE);
+
        if (vma->vm_end - vma->vm_start != PAGE_SIZE || vma->vm_pgoff)
                return -EINVAL;