Skip to contentSkip to conversation

ptp: vmclock: prevent read-only mappings from becoming writable

PATCH Applied Abdifatah Suruur 2 participants 2 messages Aug 13 – Aug 18

Subsystems (4)
Networking Network drivers PTP hardware clock support PTP vmclock support
lore
Share & tools
lore

Abdifatah Suruur

author
#0 lore raw

PATCH 1/1 ptp: vmclock: prevent read-only mappings from becoming writable

vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only.

Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071).

Reported-by Abdifatah Suruur <[email protected]>
Fixes 2050327242269 ("ptp: Add support for the AMZNC10C vmclock device")
Cc [email protected]
Signed-off-by Abdifatah Suruur <[email protected]>

---

drivers/ptp/ptp_vmclock.c +6 -0
@@ -372,6 +372,12 @@
 	if ((vma->vm_flags & (VM_READ|VM_WRITE)) != VM_READ)
 		return -EROFS;
 
+	/*
+	 * Restrict the read-only mapping so it cannot be upgraded to
+	 * writable later with mprotect().
+	 */
+	vm_flags_clear(vma, VM_MAYWRITE);
+
 	if (vma->vm_end - vma->vm_start != PAGE_SIZE || vma->vm_pgoff)
 		return -EINVAL;
CI Applied
#1 lore raw
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 11 lines · On Thu, 13 Aug 2026 20:47:07 +0300 you wrote:

vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only.

Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071).

[...]

Here is the summary with links:
- [net] ptp: vmclock: prevent read-only mappings from becoming writable
https://git.kernel.org/netdev/net/c/a5edadbae57e

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html