]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
6.12-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 9 Feb 2025 06:50:32 +0000 (07:50 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 9 Feb 2025 06:50:32 +0000 (07:50 +0100)
added patches:
platform-x86-serdev_helpers-check-for-serial_ctrl_uid-null.patch
tty-permit-some-tiocl_setsel-modes-without-cap_sys_admin.patch
tty-xilinx_uartps-split-sysrq-handling.patch

queue-6.12/platform-x86-serdev_helpers-check-for-serial_ctrl_uid-null.patch [new file with mode: 0644]
queue-6.12/series
queue-6.12/tty-permit-some-tiocl_setsel-modes-without-cap_sys_admin.patch [new file with mode: 0644]
queue-6.12/tty-xilinx_uartps-split-sysrq-handling.patch [new file with mode: 0644]

diff --git a/queue-6.12/platform-x86-serdev_helpers-check-for-serial_ctrl_uid-null.patch b/queue-6.12/platform-x86-serdev_helpers-check-for-serial_ctrl_uid-null.patch
new file mode 100644 (file)
index 0000000..20ede76
--- /dev/null
@@ -0,0 +1,54 @@
+From 478b00a623d6c8ae23a1be7bcc96cb5497045cef Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 4 Dec 2024 21:42:14 +0100
+Subject: platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 478b00a623d6c8ae23a1be7bcc96cb5497045cef upstream.
+
+dell_uart_bl_pdev_probe() calls get_serdev_controller() with the
+serial_ctrl_uid parameter set to NULL.
+
+In case of errors this NULL parameter then gets passed to pr_err()
+as argument matching a "%s" conversion specification. This leads to
+compiler warnings when building with "make W=1".
+
+Check serial_ctrl_uid before passing it to pr_err() to avoid these.
+
+Fixes: dc5afd720f84 ("platform/x86: Add new get_serdev_controller() helper")
+Cc: stable@vger.kernel.org
+Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Link: https://lore.kernel.org/r/20241204204227.95757-4-hdegoede@redhat.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/serdev_helpers.h |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/platform/x86/serdev_helpers.h
++++ b/drivers/platform/x86/serdev_helpers.h
+@@ -35,7 +35,7 @@ get_serdev_controller(const char *serial
+       ctrl_adev = acpi_dev_get_first_match_dev(serial_ctrl_hid, serial_ctrl_uid, -1);
+       if (!ctrl_adev) {
+               pr_err("error could not get %s/%s serial-ctrl adev\n",
+-                     serial_ctrl_hid, serial_ctrl_uid);
++                     serial_ctrl_hid, serial_ctrl_uid ?: "*");
+               return ERR_PTR(-ENODEV);
+       }
+@@ -43,7 +43,7 @@ get_serdev_controller(const char *serial
+       ctrl_dev = get_device(acpi_get_first_physical_node(ctrl_adev));
+       if (!ctrl_dev) {
+               pr_err("error could not get %s/%s serial-ctrl physical node\n",
+-                     serial_ctrl_hid, serial_ctrl_uid);
++                     serial_ctrl_hid, serial_ctrl_uid ?: "*");
+               ctrl_dev = ERR_PTR(-ENODEV);
+               goto put_ctrl_adev;
+       }
index a4491ce37b2405fce084f8b2f450df25859b9139..cfed7574e99dbe1fdac7052d8ecfae63af87054d 100644 (file)
@@ -93,3 +93,6 @@ kvm-e500-always-restore-irqs.patch
 drm-amdgpu-fix-circular-locking-dependency-in-amdgpu.patch
 xfs-report-realtime-block-quota-limits-on-realtime-d.patch
 xfs-don-t-over-report-free-space-or-inodes-in-statvf.patch
+tty-xilinx_uartps-split-sysrq-handling.patch
+tty-permit-some-tiocl_setsel-modes-without-cap_sys_admin.patch
+platform-x86-serdev_helpers-check-for-serial_ctrl_uid-null.patch
diff --git a/queue-6.12/tty-permit-some-tiocl_setsel-modes-without-cap_sys_admin.patch b/queue-6.12/tty-permit-some-tiocl_setsel-modes-without-cap_sys_admin.patch
new file mode 100644 (file)
index 0000000..1c9c9c4
--- /dev/null
@@ -0,0 +1,70 @@
+From 2f83e38a095f8bf7c6029883d894668b03b9bd93 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?G=C3=BCnther=20Noack?= <gnoack@google.com>
+Date: Fri, 10 Jan 2025 14:21:22 +0000
+Subject: tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Günther Noack <gnoack@google.com>
+
+commit 2f83e38a095f8bf7c6029883d894668b03b9bd93 upstream.
+
+With this, processes without CAP_SYS_ADMIN are able to use TIOCLINUX with
+subcode TIOCL_SETSEL, in the selection modes TIOCL_SETPOINTER,
+TIOCL_SELCLEAR and TIOCL_SELMOUSEREPORT.
+
+TIOCL_SETSEL was previously changed to require CAP_SYS_ADMIN, as this IOCTL
+let callers change the selection buffer and could be used to simulate
+keypresses.  These three TIOCL_SETSEL selection modes, however, are safe to
+use, as they do not modify the selection buffer.
+
+This fixes a mouse support regression that affected Emacs (invisible mouse
+cursor).
+
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/ee3ec63269b43b34e1c90dd8c9743bf8@finder.org
+Fixes: 8d1b43f6a6df ("tty: Restrict access to TIOCLINUX' copy-and-paste subcommands")
+Signed-off-by: Günther Noack <gnoack@google.com>
+Reviewed-by: Kees Cook <kees@kernel.org>
+Link: https://lore.kernel.org/r/20250110142122.1013222-1-gnoack@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/selection.c |   14 ++++++++++++++
+ drivers/tty/vt/vt.c        |    2 --
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/vt/selection.c
++++ b/drivers/tty/vt/selection.c
+@@ -192,6 +192,20 @@ int set_selection_user(const struct tioc
+       if (copy_from_user(&v, sel, sizeof(*sel)))
+               return -EFAULT;
++      /*
++       * TIOCL_SELCLEAR, TIOCL_SELPOINTER and TIOCL_SELMOUSEREPORT are OK to
++       * use without CAP_SYS_ADMIN as they do not modify the selection.
++       */
++      switch (v.sel_mode) {
++      case TIOCL_SELCLEAR:
++      case TIOCL_SELPOINTER:
++      case TIOCL_SELMOUSEREPORT:
++              break;
++      default:
++              if (!capable(CAP_SYS_ADMIN))
++                      return -EPERM;
++      }
++
+       return set_selection_kernel(&v, tty);
+ }
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -3345,8 +3345,6 @@ int tioclinux(struct tty_struct *tty, un
+       switch (type) {
+       case TIOCL_SETSEL:
+-              if (!capable(CAP_SYS_ADMIN))
+-                      return -EPERM;
+               return set_selection_user(param, tty);
+       case TIOCL_PASTESEL:
+               if (!capable(CAP_SYS_ADMIN))
diff --git a/queue-6.12/tty-xilinx_uartps-split-sysrq-handling.patch b/queue-6.12/tty-xilinx_uartps-split-sysrq-handling.patch
new file mode 100644 (file)
index 0000000..42af72c
--- /dev/null
@@ -0,0 +1,74 @@
+From b06f388994500297bb91be60ffaf6825ecfd2afe Mon Sep 17 00:00:00 2001
+From: Sean Anderson <sean.anderson@linux.dev>
+Date: Fri, 10 Jan 2025 16:38:22 -0500
+Subject: tty: xilinx_uartps: split sysrq handling
+
+From: Sean Anderson <sean.anderson@linux.dev>
+
+commit b06f388994500297bb91be60ffaf6825ecfd2afe upstream.
+
+lockdep detects the following circular locking dependency:
+
+CPU 0                      CPU 1
+========================== ============================
+cdns_uart_isr()            printk()
+  uart_port_lock(port)       console_lock()
+                            cdns_uart_console_write()
+                               if (!port->sysrq)
+                                 uart_port_lock(port)
+  uart_handle_break()
+    port->sysrq = ...
+  uart_handle_sysrq_char()
+    printk()
+      console_lock()
+
+The fixed commit attempts to avoid this situation by only taking the
+port lock in cdns_uart_console_write if port->sysrq unset. However, if
+(as shown above) cdns_uart_console_write runs before port->sysrq is set,
+then it will try to take the port lock anyway. This may result in a
+deadlock.
+
+Fix this by splitting sysrq handling into two parts. We use the prepare
+helper under the port lock and defer handling until we release the lock.
+
+Fixes: 74ea66d4ca06 ("tty: xuartps: Improve sysrq handling")
+Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
+Cc: stable@vger.kernel.org # c980248179d: serial: xilinx_uartps: Use port lock wrappers
+Acked-by: John Ogness <john.ogness@linutronix.de>
+Link: https://lore.kernel.org/r/20250110213822.2107462-1-sean.anderson@linux.dev
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/xilinx_uartps.c |    8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -287,7 +287,7 @@ static void cdns_uart_handle_rx(void *de
+                               continue;
+               }
+-              if (uart_handle_sysrq_char(port, data))
++              if (uart_prepare_sysrq_char(port, data))
+                       continue;
+               if (is_rxbs_support) {
+@@ -495,7 +495,7 @@ static irqreturn_t cdns_uart_isr(int irq
+           !(readl(port->membase + CDNS_UART_CR) & CDNS_UART_CR_RX_DIS))
+               cdns_uart_handle_rx(dev_id, isrstatus);
+-      uart_port_unlock(port);
++      uart_unlock_and_check_sysrq(port);
+       return IRQ_HANDLED;
+ }
+@@ -1380,9 +1380,7 @@ static void cdns_uart_console_write(stru
+       unsigned int imr, ctrl;
+       int locked = 1;
+-      if (port->sysrq)
+-              locked = 0;
+-      else if (oops_in_progress)
++      if (oops_in_progress)
+               locked = uart_port_trylock_irqsave(port, &flags);
+       else
+               uart_port_lock_irqsave(port, &flags);