[PATCH v2 1/2] drm/panthor: Fix handling of NO_MMAP BOs

[PATCH v2 1/2] drm/panthor: Fix handling of NO_MMAP BOs

[Akash Goel]

The BOs created with DRM_PANTHOR_BO_NO_MMAP flag are not supposed to be
mmappable by the Userspace. But after the rework to support shrinker,
it became possible to mmap NO_MMAP BOs. Userspace could second guess
the file offset range, allocated unconditionally at the BO creation
time, and create a CPU mapping. There may not be any adverse effect of
such a CPU mapping though.
This commit adds a check in the mmap callback of Panthor driver to
fail the mmap() attempts on BOs created with NO_MMAP flag. The check
covers private BOs as well as the prime exported BOs that are mmapped
using prime fd.

v2:
 - Fix breakage of mmap() on exported BOs that didn't have
   BO_MMAP_OFFSET ioctl invoked for them.

Fixes: 68cbf96b1e9b ("drm/panthor: Part ways with drm_gem_shmem_object")
Suggested-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Akash Goel <akash.goel@arm.com>
---
 drivers/gpu/drm/panthor/panthor_gem.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/panthor/panthor_gem.c b/drivers/gpu/drm/panthor/panthor_gem.c
index c07a44057e42..22b57ab6f929 100644
--- a/drivers/gpu/drm/panthor/panthor_gem.c
+++ b/drivers/gpu/drm/panthor/panthor_gem.c
@@ -744,6 +744,9 @@ static int panthor_gem_mmap(struct drm_gem_object *obj, struct vm_area_struct *v
 	struct panthor_gem_object *bo = to_panthor_bo(obj);
 	int ret;
 
+	if (bo->flags & DRM_PANTHOR_BO_NO_MMAP)
+		return -EINVAL;
+
 	if (drm_gem_is_imported(obj)) {
 		/* Reset both vm_ops and vm_private_data, so we don't end up with
 		 * vm_ops pointing to our implementation if the dma-buf backend
-- 
2.25.1

[PATCH v2 2/2] drm/panthor: Remove redundant drm_gem_create_mmap_offset() call from BO_MMAP_OFFSET ioctl

[Akash Goel]

This commit removes the call to drm_gem_create_mmap_offset() from
the BO_MMAP_OFFSET ioctl handler. The call was redundant and didn't
have any effect as file offset range is allocated unconditionally
at the BO creation time.

v2:
- New patch

Suggested-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Akash Goel <akash.goel@arm.com>
---
 drivers/gpu/drm/panthor/panthor_drv.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/panthor/panthor_drv.c b/drivers/gpu/drm/panthor/panthor_drv.c
index 1ca8aedd83f4..dc8d0191aef4 100644
--- a/drivers/gpu/drm/panthor/panthor_drv.c
+++ b/drivers/gpu/drm/panthor/panthor_drv.c
@@ -1081,7 +1081,7 @@ static int panthor_ioctl_bo_mmap_offset(struct drm_device *ddev, void *data,
 	struct drm_panthor_bo_mmap_offset *args = data;
 	struct panthor_gem_object *bo;
 	struct drm_gem_object *obj;
-	int ret;
+	int ret = 0;
 
 	if (args->pad)
 		return -EINVAL;
@@ -1096,10 +1096,6 @@ static int panthor_ioctl_bo_mmap_offset(struct drm_device *ddev, void *data,
 		goto out;
 	}
 
-	ret = drm_gem_create_mmap_offset(obj);
-	if (ret)
-		goto out;
-
 	args->offset = drm_vma_node_offset_addr(&obj->vma_node);
 
 out:
-- 
2.25.1

Re: [PATCH v2 2/2] drm/panthor: Remove redundant drm_gem_create_mmap_offset() call from BO_MMAP_OFFSET ioctl

[Liviu Dudau]

On Tue, Oct 13, 2026 at 01:54:33PM +0100, Akash Goel wrote:
> This commit removes the call to drm_gem_create_mmap_offset() from
> the BO_MMAP_OFFSET ioctl handler. The call was redundant and didn't
> have any effect as file offset range is allocated unconditionally
> at the BO creation time.
> 
> v2:
> - New patch
> 
> Suggested-by: Boris Brezillon <boris.brezillon@collabora.com>
> Signed-off-by: Akash Goel <akash.goel@arm.com>

Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>

Best regards,
Liviu

> ---
>  drivers/gpu/drm/panthor/panthor_drv.c | 6 +-----
>  1 file changed, 1 insertion(+), 5 deletions(-)
> 
> diff --git a/drivers/gpu/drm/panthor/panthor_drv.c b/drivers/gpu/drm/panthor/panthor_drv.c
> index 1ca8aedd83f4..dc8d0191aef4 100644
> --- a/drivers/gpu/drm/panthor/panthor_drv.c
> +++ b/drivers/gpu/drm/panthor/panthor_drv.c
> @@ -1081,7 +1081,7 @@ static int panthor_ioctl_bo_mmap_offset(struct drm_device *ddev, void *data,
>  	struct drm_panthor_bo_mmap_offset *args = data;
>  	struct panthor_gem_object *bo;
>  	struct drm_gem_object *obj;
> -	int ret;
> +	int ret = 0;
>  
>  	if (args->pad)
>  		return -EINVAL;
> @@ -1096,10 +1096,6 @@ static int panthor_ioctl_bo_mmap_offset(struct drm_device *ddev, void *data,
>  		goto out;
>  	}
>  
> -	ret = drm_gem_create_mmap_offset(obj);
> -	if (ret)
> -		goto out;
> -
>  	args->offset = drm_vma_node_offset_addr(&obj->vma_node);
>  
>  out:
> -- 
> 2.25.1
> 

-- 
====================
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯