This is a note to let you know that I've just added the patch titled
fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace to the 6.2-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: fbmem-reject-fb_activate_kd_text-from-userspace.patch and it can be found in the queue-6.2 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <sta...@vger.kernel.org> know about it. >From 6fd33a3333c7916689b8f051a185defe4dd515b0 Mon Sep 17 00:00:00 2001 From: Daniel Vetter <daniel.vet...@ffwll.ch> Date: Tue, 4 Apr 2023 21:39:34 +0200 Subject: fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Daniel Vetter <daniel.vet...@ffwll.ch> commit 6fd33a3333c7916689b8f051a185defe4dd515b0 upstream. This is an oversight from dc5bdb68b5b3 ("drm/fb-helper: Fix vt restore") - I failed to realize that nasty userspace could set this. It's not pretty to mix up kernel-internal and userspace uapi flags like this, but since the entire fb_var_screeninfo structure is uapi we'd need to either add a new parameter to the ->fb_set_par callback and fb_set_par() function, which has a _lot_ of users. Or some other fairly ugly side-channel int fb_info. Neither is a pretty prospect. Instead just correct the issue at hand by filtering out this kernel-internal flag in the ioctl handling code. Reviewed-by: Javier Martinez Canillas <javi...@redhat.com> Acked-by: Maarten Lankhorst <maarten.lankho...@linux.intel.com> Signed-off-by: Daniel Vetter <daniel.vet...@intel.com> Fixes: dc5bdb68b5b3 ("drm/fb-helper: Fix vt restore") Cc: Alex Deucher <alexander.deuc...@amd.com> Cc: shl...@fastmail.com Cc: Michel Dänzer <mic...@daenzer.net> Cc: Noralf Trønnes <nor...@tronnes.org> Cc: Thomas Zimmermann <tzimmerm...@suse.de> Cc: Daniel Vetter <daniel.vet...@intel.com> Cc: Maarten Lankhorst <maarten.lankho...@linux.intel.com> Cc: Maxime Ripard <mrip...@kernel.org> Cc: David Airlie <airl...@linux.ie> Cc: Daniel Vetter <dan...@ffwll.ch> Cc: dri-devel@lists.freedesktop.org Cc: <sta...@vger.kernel.org> # v5.7+ Cc: Bartlomiej Zolnierkiewicz <b.zolnier...@samsung.com> Cc: Geert Uytterhoeven <ge...@linux-m68k.org> Cc: Nathan Chancellor <natechancel...@gmail.com> Cc: Qiujun Huang <hqjag...@gmail.com> Cc: Peter Rosin <p...@axentia.se> Cc: linux-fb...@vger.kernel.org Cc: Helge Deller <del...@gmx.de> Cc: Sam Ravnborg <s...@ravnborg.org> Cc: Geert Uytterhoeven <geert+rene...@glider.be> Cc: Samuel Thibault <samuel.thiba...@ens-lyon.org> Cc: Tetsuo Handa <penguin-ker...@i-love.sakura.ne.jp> Cc: Shigeru Yoshida <syosh...@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230404193934.472457-1-daniel.vet...@ffwll.ch Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org> --- drivers/video/fbdev/core/fbmem.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -1117,6 +1117,8 @@ static long do_fb_ioctl(struct fb_info * case FBIOPUT_VSCREENINFO: if (copy_from_user(&var, argp, sizeof(var))) return -EFAULT; + /* only for kernel-internal use */ + var.activate &= ~FB_ACTIVATE_KD_TEXT; console_lock(); lock_fb_info(info); ret = fbcon_modechange_possible(info, &var); Patches currently in stable-queue which might be from daniel.vet...@ffwll.ch are queue-6.2/fbmem-reject-fb_activate_kd_text-from-userspace.patch