Thanks Christian and T.J! Yes, please go ahead and push this one to drm-misc-fixes (unless Sumit would prefer to take it). I will send out a separate patch for drm-misc-next enforcing the check in dma_buf_mmap_internal() and dma_buf_mmap() so we can see if anything in userspace complains.
On Mon, Nov 2, 2026 at 3:09 AM Christian König <[email protected]> wrote: > On 10/31/26 02:44, T.J. Mercier wrote: > > On Fri, Oct 30, 2026 at 1:44 PM Chris Wiseman <[email protected]> > wrote: > >> > >> When commit 381295758792 ("dma-buf: system_heap: Rework system heap to > >> use sgtables instead of pagelists") stopped using heap_helpers.c and > >> added a custom system_heap_mmap(), the check rejecting private mappings > >> was dropped. > >> > >> Other exporters and buffer allocators reject private or copy-on-write > >> mappings in their mmap handlers: cma_heap_mmap() and mmap_udmabuf() > >> check that VM_SHARED or VM_MAYSHARE is set, and drm_gem_shmem_mmap() > >> and ttm_bo_mmap_obj() reject vma_is_cow_mapping(vma). > >> > >> However, system_heap_mmap() omits this check and calls remap_pfn_range() > >> even when userspace requests MAP_PRIVATE with PROT_WRITE. As a result, > >> subsequent CPU writes to a MAP_PRIVATE mapping of a system heap buffer > >> fault into do_wp_page() -> wp_page_copy(), silently allocating private > >> anonymous copy-on-write pages whose writes never reach the underlying > >> system heap buffer pages. > >> > >> Reject non-shared mappings in system_heap_mmap() with -EINVAL to match > >> cma_heap_mmap() and mmap_udmabuf(). > >> > >> Fixes: 381295758792 ("dma-buf: system_heap: Rework system heap to use > sgtables instead of pagelists") > >> Cc: [email protected] > >> Signed-off-by: Chris Wiseman <[email protected]> > > > > Reviewed-by: T.J. Mercier <[email protected]> > > > > I wonder if we should have this in dma_buf_mmap_internal() though. Any > > thoughts Sumit or Christian? > > I do remember that this was once already discussed with Simona and a > couple of others, but I don't remember what the outcome was. > > On the other hand I can't think of a reason why anybody would want a > private mapping with DMA-buf copy on write clearly won't work. Maybe for > backward compatibility with broken userspace, not for a real use case. > > I would say let's push this patch to drm-misc-fixes and apply another > patch to drm-misc-next to enforce this for all DMA-bufs and see if anybody > complains that this breaks userspace. > > Should I push it to drm-misc-fixes or want somebody else take that? > > Regards, > Christian. >
