[lvc-project] [PATCH 6.1] drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)

[Fedor Pchelkin]

On Fri, 18. Oct 12:43, Artem Sdvizhkov wrote:
> From: "Artem Sdvizhkov" <a.sdvizhkov at securitycode.ru>
> 
> From: "Wachowski, Karol" <karol.wachowski at intel.com>
> 
> commit 39bc27bd688066a63e56f7f64ad34fae03fbe3b8 upstream.
> 
> Lack of check for copy-on-write (COW) mapping in drm_gem_shmem_mmap
> allows users to call mmap with PROT_WRITE and MAP_PRIVATE flag
> causing a kernel panic due to BUG_ON in vmf_insert_pfn_prot:
> BUG_ON((vma->vm_flags & VM_PFNMAP) && is_cow_mapping(vma->vm_flags));
> 
> Return -EINVAL early if COW mapping is detected.
> 
> This bug affects all drm drivers using default shmem helpers.
> It can be reproduced by this simple example:
> void *ptr = mmap(0, size, PROT_WRITE, MAP_PRIVATE, fd, mmap_offset);
> ptr[0] = 0;
> 
> Fixes: 2194a63a818d ("drm: Add library for shmem backed GEM objects")
> Signed-off-by: Wachowski, Karol <karol.wachowski at intel.com>
> Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz at linux.intel.com>
> Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
> Signed-off-by: Artem Sdvizhkov <a.sdvizhkov at securitycode.ru>
> Link: https://patchwork.freedesktop.org/patch/msgid/20240520100514.925681-1-jacek.lawrynowicz@linux.intel.com
> ---
>  drivers/gpu/drm/drm_gem_shmem_helper.c | 3 +++
>  1 file changed, 3 insertions(+)

Для 5.15/6.1 веток буквально на днях (вот надо же!) был отправлен и принят
бэкпорт-патч: https://lore.kernel.org/stable/2024101845-dictator-contusion-bf29@gregkh/