drm/vc4: Prevent shader BO mappings from becoming writable

vc4_gem_object_mmap() rejects a writable mapping of a validated shader
BO, but leaves VM_MAYWRITE set.  Userspace can map the BO read-only and
then turn it writable with mprotect().

Validated shader BOs must stay read-only: the validator checks the
instructions once and the GPU trusts them afterwards.  A writable
mapping lets userspace rewrite the code after validation, bypassing the
validator.

Clear VM_MAYWRITE on the read-only path so the mapping cannot be
upgraded, as i915 already does for its read-only objects.

Fixes: 463873d57014 ("drm/vc4: Add an API for creating GPU shaders in GEM BOs.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/dri-devel/20260720085554.B0AF01F000E9@smtp.kernel.org/
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Link: https://patch.msgid.link/20260721011558.1672477-1-lilinmao@kylinos.cn
Reviewed-by: Maíra Canal <mcanal@igalia.com>
Signed-off-by: Maíra Canal <mcanal@igalia.com>

diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
index 2161761b1f2215c3ce7054caf21019d4be5c70d9..5e7c46dd7823abb68fdc50fa25b03eeb0e08ea84 100644 (file)
--- a/drivers/gpu/drm/vc4/vc4_bo.c
+++ b/drivers/gpu/drm/vc4/vc4_bo.c
@@ -732,9 +732,13 @@ static int vc4_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_struct
 {
        struct vc4_bo *bo = to_vc4_bo(obj);
 
-       if (bo->validated_shader && (vma->vm_flags & VM_WRITE)) {
-               DRM_DEBUG("mmapping of shader BOs for writing not allowed.\n");
-               return -EINVAL;
+       if (bo->validated_shader) {
+               if (vma->vm_flags & VM_WRITE) {
+                       DRM_DEBUG("mmapping of shader BOs for writing not allowed.\n");
+                       return -EINVAL;
+               }
+
+               vm_flags_clear(vma, VM_MAYWRITE);
        }
 
        mutex_lock(&bo->madv_lock);