[PATCH v3 25/40] mm/vma: enforce that only kernel-owned mappings may set VMA_IO_BIT
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Date: 2026-09-17 16:35:43
Also in:
bpf, dri-devel, fuse-devel, kvm, kvm-riscv, kvmarm, linux-arch, linux-doc, linux-fsdevel, linux-mm, linux-perf-users, linux-rdma, linux-riscv, linux-s390, linux-scsi, linux-sound, linux-trace-kernel, linux-usb, linuxppc-dev, lkml, selinux, sparclinux
Subsystem:
memory management, memory mapping, the rest · Maintainers:
Andrew Morton, Liam R. Howlett, Lorenzo Stoakes, Linus Torvalds
It makes no sense for a mapping whose contents the kernel does not own to specify that the range is MMIO. Prior to this patch, all in-tree drivers which did so have been updated such that they are marked as kernel-owned. The check WARNs and fails the mmap for any out-of-tree driver that still sets VMA_IO_BIT without a kernel mapping. No functional change intended for in-tree code. Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> --- mm/vma.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/mm/vma.c b/mm/vma.c
index 1db8b218fe64..56a0cd154419 100644
--- a/mm/vma.c
+++ b/mm/vma.c@@ -2787,6 +2787,12 @@ static int mmap_validate_vma_flags(const vma_flags_t *flags) return -EINVAL; #endif + if (!vma_flags_test_any(flags, VMA_PFNMAP_BIT, VMA_MIXEDMAP_BIT)) { + /* Only kernel-owned mappings may set VMA_IO_BIT. */ + if (WARN_ON_ONCE(vma_flags_test(flags, VMA_IO_BIT))) + return -EINVAL; + } + return 0; }
--
2.55.0