This is a note to let you know that I've just added the patch titled
fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
fbmem-reject-fb_activate_kd_text-from-userspace.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 6fd33a3333c7916689b8f051a185defe4dd515b0 Mon Sep 17 00:00:00 2001
From: Daniel Vetter <[email protected]>
Date: Tue, 4 Apr 2023 21:39:34 +0200
Subject: fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: Daniel Vetter <[email protected]>
commit 6fd33a3333c7916689b8f051a185defe4dd515b0 upstream.
This is an oversight from dc5bdb68b5b3 ("drm/fb-helper: Fix vt
restore") - I failed to realize that nasty userspace could set this.
It's not pretty to mix up kernel-internal and userspace uapi flags
like this, but since the entire fb_var_screeninfo structure is uapi
we'd need to either add a new parameter to the ->fb_set_par callback
and fb_set_par() function, which has a _lot_ of users. Or some other
fairly ugly side-channel int fb_info. Neither is a pretty prospect.
Instead just correct the issue at hand by filtering out this
kernel-internal flag in the ioctl handling code.
Reviewed-by: Javier Martinez Canillas <[email protected]>
Acked-by: Maarten Lankhorst <[email protected]>
Signed-off-by: Daniel Vetter <[email protected]>
Fixes: dc5bdb68b5b3 ("drm/fb-helper: Fix vt restore")
Cc: Alex Deucher <[email protected]>
Cc: [email protected]
Cc: Michel Dänzer <[email protected]>
Cc: Noralf Trønnes <[email protected]>
Cc: Thomas Zimmermann <[email protected]>
Cc: Daniel Vetter <[email protected]>
Cc: Maarten Lankhorst <[email protected]>
Cc: Maxime Ripard <[email protected]>
Cc: David Airlie <[email protected]>
Cc: Daniel Vetter <[email protected]>
Cc: [email protected]
Cc: <[email protected]> # v5.7+
Cc: Bartlomiej Zolnierkiewicz <[email protected]>
Cc: Geert Uytterhoeven <[email protected]>
Cc: Nathan Chancellor <[email protected]>
Cc: Qiujun Huang <[email protected]>
Cc: Peter Rosin <[email protected]>
Cc: [email protected]
Cc: Helge Deller <[email protected]>
Cc: Sam Ravnborg <[email protected]>
Cc: Geert Uytterhoeven <[email protected]>
Cc: Samuel Thibault <[email protected]>
Cc: Tetsuo Handa <[email protected]>
Cc: Shigeru Yoshida <[email protected]>
Link:
https://patchwork.freedesktop.org/patch/msgid/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/video/fbdev/core/fbmem.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -1119,6 +1119,8 @@ static long do_fb_ioctl(struct fb_info *
case FBIOPUT_VSCREENINFO:
if (copy_from_user(&var, argp, sizeof(var)))
return -EFAULT;
+ /* only for kernel-internal use */
+ var.activate &= ~FB_ACTIVATE_KD_TEXT;
console_lock();
lock_fb_info(info);
ret = fbcon_modechange_possible(info, &var);
Patches currently in stable-queue which might be from [email protected] are
queue-5.15/fbmem-reject-fb_activate_kd_text-from-userspace.patch
