drm/i915/dpt: Make DPT object unshrinkable

jira LE-3201
cve CVE-2024-40924
Rebuild_History Non-Buildable kernel-rt-4.18.0-553.27.1.rt7.368.el8_10
commit-author Vidya Srinivas <[email protected]>
commit 51064d4

In some scenarios, the DPT object gets shrunk but
the actual framebuffer did not and thus its still
there on the DPT's vm->bound_list. Then it tries to
rewrite the PTEs via a stale CPU mapping. This causes panic.

	Cc: [email protected]
	Reported-by: Shawn Lee <[email protected]>
Fixes: 0dc987b ("drm/i915/display: Add smem fallback allocation for dpt")
	Signed-off-by: Vidya Srinivas <[email protected]>
[vsyrjala: Add TODO comment]
	Signed-off-by: Ville Syrjälä <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
(cherry picked from commit 51064d4)
	Signed-off-by: Jonathan Maple <[email protected]>

Author: PlaidCat

drivers/gpu/drm/i915/gem/i915_gem_object.h

@@ -280,7 +280,9 @@ bool i915_gem_object_has_iomem(const struct drm_i915_gem_object *obj);
 static inline bool
 i915_gem_object_is_shrinkable(const struct drm_i915_gem_object *obj)
 {
-	return i915_gem_object_type_has(obj, I915_GEM_OBJECT_IS_SHRINKABLE);
+	/* TODO: make DPT shrinkable when it has no bound vmas */
+	return i915_gem_object_type_has(obj, I915_GEM_OBJECT_IS_SHRINKABLE) &&
+		!obj->is_dpt;
 }
 
 static inline bool