drm/vc4 ShaderBO Bypass

Vulnerability analysis

The vc4 graphics driver checks GPU shader code for safety when a shader buffer is first created, then trusts that check for all later GPU execution. When userspace asks to map one of these buffers, the driver refuses direct writable mappings, but it still leaves open the possibility of upgrading the mapping to writable later. A user can therefore request a read-only mapping and then promote it to writable using standard memory protection calls, rewriting shader instructions after the safety check has already passed. This bypasses the validator that is meant to prevent shaders from performing unrestricted direct memory access to system memory. The fix removes the upgrade permission so a read-only mapping stays read-only permanently, matching how another graphics driver handles similar objects. Any local user with access to the vc4 graphics device can trigger this; on Raspberry Pi systems this device is typically available to members of the video group without requiring administrator privileges.