Re: [PATCH] char: uv_mmtimer: prevent read-only mapping from becoming writable

[Greg KH]

On Thu, Oct 29, 2026 at 11:54:13AM +0800, bo cao wrote:
> uv_mmtimer_mmap() rejects writable mappings but leaves VM_MAYWRITE
> set.  Userspace can map the clock's MMR page read-only and then
> upgrade the mapping to writable with mprotect(), gaining write access
> to the UVH_RTC register that the driver explicitly declares
> read-only.
> 
> Clear VM_MAYWRITE, as fixed in vfio/platform (commit 420bed9131db),
> drm/vc4 (CVE-2026-68445), drm/panthor (CVE-2024-53071) and
> ptp/vmclock (commit a5edadbae57e).
> 
> Note this is defensive hardening on two counts: /dev/uv_mmtimer is
> created with the default 0600 mode (exploitation requires root), and
> the driver only exists on SGI UV systems.
> 
> Fixes: fbd8ae106850 ("drivers/char/uv_mmtimer.c: add memory mapped RTC driver for UV")
> Signed-off-by: bo cao <treebacker@xxxxxxxxxxx>
> ---
>  drivers/char/uv_mmtimer.c | 3 +++
>  1 file changed, 3 insertions(+)

Your LLM just picked up a patch I sent previously:
	https://lore.kernel.org/r/2026102752-extrovert-undaunted-d6cb@gregkh

thanks,

greg k-h