Re: [PATCH] fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace
From: Daniel Vetter <hidden>
Date: 2023-04-11 13:44:54
Also in:
dri-devel, intel-gfx, stable
On Tue, Apr 04, 2023 at 09:39:34PM +0200, Daniel Vetter wrote:
This is an oversight from dc5bdb68b5b3 ("drm/fb-helper: Fix vt
restore") - I failed to realize that nasty userspace could set this.
It's not pretty to mix up kernel-internal and userspace uapi flags
like this, but since the entire fb_var_screeninfo structure is uapi
we'd need to either add a new parameter to the ->fb_set_par callback
and fb_set_par() function, which has a _lot_ of users. Or some other
fairly ugly side-channel int fb_info. Neither is a pretty prospect.
Instead just correct the issue at hand by filtering out this
kernel-internal flag in the ioctl handling code.
Signed-off-by: Daniel Vetter <redacted>
Fixes: dc5bdb68b5b3 ("drm/fb-helper: Fix vt restore")
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: shlomo@fastmail.com
Cc: Michel Dänzer <redacted>
Cc: Noralf Trønnes <redacted>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Daniel Vetter <redacted>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: David Airlie <redacted>
Cc: Daniel Vetter <redacted>
Cc: dri-devel@lists.freedesktop.org
Cc: <redacted> # v5.7+
Cc: Bartlomiej Zolnierkiewicz <redacted>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Nathan Chancellor <redacted>
Cc: Qiujun Huang <redacted>
Cc: Peter Rosin <redacted>
Cc: linux-fbdev@vger.kernel.org
Cc: Helge Deller <deller@gmx.de>
Cc: Sam Ravnborg <redacted>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: Samuel Thibault <samuel.thibault@ens-lyon.org>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Shigeru Yoshida <redacted>An Ack on this (or a better idea) would be great, so I can stuff it into -fixes. Thanks, Daniel
quoted hunk ↗ jump to hunk
--- drivers/video/fbdev/core/fbmem.c | 2 ++ 1 file changed, 2 insertions(+)diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c index 875541ff185b..3fd95a79e4c3 100644 --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c@@ -1116,6 +1116,8 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, case FBIOPUT_VSCREENINFO: if (copy_from_user(&var, argp, sizeof(var))) return -EFAULT; + /* only for kernel-internal use */ + var.activate &= ~FB_ACTIVATE_KD_TEXT; console_lock(); lock_fb_info(info); ret = fbcon_modechange_possible(info, &var);-- 2.40.0
-- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch