On Mon, Nov 2, 2026 at 8:00 AM Chris Wiseman chriswiseman@google.com wrote:

DMA-BUF mappings do not support copy-on-write. Mapping a dma-buf with MAP_PRIVATE and PROT_WRITE faults into do_wp_page() -> wp_page_copy() and allocates private anonymous pages whose writes never reach the underlying buffer.

Individual exporters like cma_heap_mmap(), system_heap_mmap(), and mmap_udmabuf() already require (VM_SHARED | VM_MAYSHARE), and DRM helpers like ttm_bo_mmap_obj() and drm_gem_shmem_object_mmap() reject vma_is_cow_mapping(vma). However, dma_buf_mmap_internal() and dma_buf_mmap() do not check for this and pass MAP_PRIVATE mappings straight through to dmabuf->ops->mmap().

Reject mappings with -EINVAL in both dma_buf_mmap_internal() and dma_buf_mmap() when neither VM_SHARED nor VM_MAYSHARE is set. Checking both flags still allows read-only MAP_SHARED mappings, where do_mmap() clears VM_SHARED and leaves VM_MAYSHARE set.

Suggested-by: T.J. Mercier tjmercier@google.com Suggested-by: Christian König christian.koenig@amd.com Signed-off-by: Chris Wiseman chriswiseman@google.com

I really hope nobody is trying to CoW with dma-bufs.

Reviewed-by: T.J. Mercier tjmercier@google.com