vfio_cdx_mmap() accepts MAP_PRIVATE mappings. A non-shared mapping with VM_MAYWRITE is a COW mapping, and remap_pfn_range()'s COW special case in get_remap_pgoff() then overwrites vma->vm_pgoff with the physical frame number: if (is_cow) { if (addr != vm_start || end != vm_end) return -EINVAL; *vm_pgoff_p = pfn; } The VMA is inserted into the device file's mapping->i_mmap interval tree keyed by vm_pgoff, which VFIO expects to be the logical file offset: the core links every device mmap to the device inode's i_mapping precisely so that unmap_mapping_range() can revoke all mappings associated with a device (see vfio_device_cdev_open()). A raw PFN in vm_pgoff lands the interval tree entry in the wrong coordinate space, so unmap_mapping_range() cannot find the VMA and a stale MMIO mapping survives any revocation attempt. Without this check, a MAP_PRIVATE mapping reintroduces that corruption even with the logical-vm_pgoff fix in place. Require VM_SHARED as vfio-pci, vfio/fsl-mc and vfio/platform already do. Fixes: 234489ac56130 ("vfio/cdx: add support for CDX bus") Signed-off-by: Abdifatah Suruur --- drivers/vfio/cdx/main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/vfio/cdx/main.c b/drivers/vfio/cdx/main.c index b31ed4be7bdc1..6d208db0896d6 100644 --- a/drivers/vfio/cdx/main.c +++ b/drivers/vfio/cdx/main.c @@ -271,6 +271,9 @@ static int vfio_cdx_mmap(struct vfio_device *core_vdev, index = vma->vm_pgoff >> (VFIO_CDX_OFFSET_SHIFT - PAGE_SHIFT); + if (!(vma->vm_flags & VM_SHARED)) + return -EINVAL; + if (index >= cdx_dev->res_count) return -EINVAL; -- 2.53.0