From nobody Sat Jul 25 01:37:50 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3781ADDA9; Tue, 21 Jul 2026 01:16:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784596576; cv=none; b=R2UFknbWLAaSD1Z/mlxmtJR5UNSj/Ns7o4vB0EQDxLaZr/ZpPmBP4ngl67VAZRCPqJG39i2oZzWT8ybiKFQytnNrUT42dAABbXaW2CuVzf+TRq2nZ2O3ryOMia2J5OWXu1mYiZkLZ52hDobwxi5K4Z4d50E6Xz6FwX05AtbwHSY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784596576; c=relaxed/simple; bh=OqYBYrcJJwWhnFI0QkiA2+LSHzV+2KIS2ZdGgUhl8Ko=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=fyBxl8H5m76u8FiKbWddom54eZGGLQ6M4dIYWbIy1JBrASIZdiGsyzGUhpKC9HQ59CCZKG0znIYKdIEvpGZPnw/CenyHGNzRqiVO3zxmkykeM06kDO2+LIy0xayTD7h+3/NInWDc9prUPfQkvGBQq5a0NSFFs7WTGlHnfc+IUpU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: c003c35a84a111f1aa26b74ffac11d73-20260721 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:a11b9ea3-9fb6-418f-8c87-62669e37c309,IP:0,U RL:0,TC:0,Content:-25,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:-25 X-CID-META: VersionHash:e7bac3a,CLOUDID:6ca964d20c1be408408dd0f51fef32ef,BulkI D:nil,BulkQuantity:0,Recheck:0,SF:102|850|865|898,TC:nil,Content:0|15|50,E DM:-3,IP:nil,URL:99|1,File:nil,RT:nil,Bulk:nil,QS:nil,BEC:nil,COL:0,OSI:0, OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR,TF_CID_SPAM_ULS X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: c003c35a84a111f1aa26b74ffac11d73-20260721 X-User: lilinmao@kylinos.cn Received: from localhost.localdomain [(10.44.16.150)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1513926998; Tue, 21 Jul 2026 09:16:07 +0800 From: Linmao Li To: Maxime Ripard , Dave Stevenson Cc: =?UTF-8?q?Ma=C3=ADra=20Canal?= , Raspberry Pi Kernel Maintenance , Maarten Lankhorst , Thomas Zimmermann , David Airlie , Simona Vetter , Eric Anholt , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Linmao Li , stable@vger.kernel.org, sashiko-bot@kernel.org Subject: [PATCH] drm/vc4: Prevent shader BO mappings from becoming writable Date: Tue, 21 Jul 2026 09:15:58 +0800 Message-Id: <20260721011558.1672477-1-lilinmao@kylinos.cn> X-Mailer: git-send-email 2.25.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vc4_gem_object_mmap() rejects a writable mapping of a validated shader BO, but leaves VM_MAYWRITE set. Userspace can map the BO read-only and then turn it writable with mprotect(). Validated shader BOs must stay read-only: the validator checks the instructions once and the GPU trusts them afterwards. A writable mapping lets userspace rewrite the code after validation, bypassing the validator. Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 already does for its read-only objects. Fixes: 463873d57014 ("drm/vc4: Add an API for creating GPU shaders in GEM B= Os.") Cc: stable@vger.kernel.org Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/dri-devel/20260720085554.B0AF01F000E9@smtp.= kernel.org/ Signed-off-by: Linmao Li --- drivers/gpu/drm/vc4/vc4_bo.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c index 2161761b1f22..5e7c46dd7823 100644 --- a/drivers/gpu/drm/vc4/vc4_bo.c +++ b/drivers/gpu/drm/vc4/vc4_bo.c @@ -732,9 +732,13 @@ static int vc4_gem_object_mmap(struct drm_gem_object *= obj, struct vm_area_struct { struct vc4_bo *bo =3D to_vc4_bo(obj); =20 - if (bo->validated_shader && (vma->vm_flags & VM_WRITE)) { - DRM_DEBUG("mmapping of shader BOs for writing not allowed.\n"); - return -EINVAL; + if (bo->validated_shader) { + if (vma->vm_flags & VM_WRITE) { + DRM_DEBUG("mmapping of shader BOs for writing not allowed.\n"); + return -EINVAL; + } + + vm_flags_clear(vma, VM_MAYWRITE); } =20 mutex_lock(&bo->madv_lock); --=20 2.25.1