5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kazuki Hanai [ Upstream commit 71c610aeb1770302ac9c9e0b9a4ecd37f1311928 ] The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VM_MAYWRITE set on mappings created with PROT_READ. A process that can open the hwdep node O_RDWR can later use mprotect() to make the mapping writable. The read allocation begins with struct usb_stream. Its read_size member is used by the fault handler to decide which pages belong to the read buffer. The read VMA intentionally remains expandable because pcm_usb_stream uses mremap() after reading that size. Changing read_size first can therefore map and access pages beyond the allocation. The same member is also consumed by usb_stream_free(), where changing it can make free_pages_exact() release pages outside the allocation. Clear VM_MAYWRITE for read-buffer mappings after rejecting an initially writable VMA. This keeps the separate output-buffer mapping writable while preventing later permission upgrades. Fixes: 030a07e44129 ("ALSA: Add USB US122L driver") Cc: stable@vger.kernel.org Signed-off-by: Kazuki Hanai Link: https://patch.msgid.link/20260908110053.2950767-1-hnkz.64@gmail.com Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin --- sound/usb/usx2y/us122l.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c index 23d7d542a3de6..21c5a7fcea768 100644 --- a/sound/usb/usx2y/us122l.c +++ b/sound/usb/usx2y/us122l.c @@ -209,9 +209,12 @@ static int usb_stream_hwdep_mmap(struct snd_hwdep *hw, mutex_lock(&us122l->mutex); s = us122l->sk.s; read = offset < s->read_size; - if (read && area->vm_flags & VM_WRITE) { - err = -EPERM; - goto out; + if (read) { + if (area->vm_flags & VM_WRITE) { + err = -EPERM; + goto out; + } + area->vm_flags &= ~VM_MAYWRITE; } snd_printdd(KERN_DEBUG "%lu %u\n", size, read ? s->read_size : s->write_size); -- 2.53.0