From: Greg Kroah-Hartman Date: Sun, 9 Feb 2025 06:50:32 +0000 (+0100) Subject: 6.12-stable patches X-Git-Tag: v6.6.77~39 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3f690dcff8b42ea229eb10a05d9876761ace992d;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: platform-x86-serdev_helpers-check-for-serial_ctrl_uid-null.patch tty-permit-some-tiocl_setsel-modes-without-cap_sys_admin.patch tty-xilinx_uartps-split-sysrq-handling.patch --- diff --git a/queue-6.12/platform-x86-serdev_helpers-check-for-serial_ctrl_uid-null.patch b/queue-6.12/platform-x86-serdev_helpers-check-for-serial_ctrl_uid-null.patch new file mode 100644 index 0000000000..20ede7618d --- /dev/null +++ b/queue-6.12/platform-x86-serdev_helpers-check-for-serial_ctrl_uid-null.patch @@ -0,0 +1,54 @@ +From 478b00a623d6c8ae23a1be7bcc96cb5497045cef Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 4 Dec 2024 21:42:14 +0100 +Subject: platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +commit 478b00a623d6c8ae23a1be7bcc96cb5497045cef upstream. + +dell_uart_bl_pdev_probe() calls get_serdev_controller() with the +serial_ctrl_uid parameter set to NULL. + +In case of errors this NULL parameter then gets passed to pr_err() +as argument matching a "%s" conversion specification. This leads to +compiler warnings when building with "make W=1". + +Check serial_ctrl_uid before passing it to pr_err() to avoid these. + +Fixes: dc5afd720f84 ("platform/x86: Add new get_serdev_controller() helper") +Cc: stable@vger.kernel.org +Suggested-by: Ilpo Järvinen +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20241204204227.95757-4-hdegoede@redhat.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/serdev_helpers.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/platform/x86/serdev_helpers.h ++++ b/drivers/platform/x86/serdev_helpers.h +@@ -35,7 +35,7 @@ get_serdev_controller(const char *serial + ctrl_adev = acpi_dev_get_first_match_dev(serial_ctrl_hid, serial_ctrl_uid, -1); + if (!ctrl_adev) { + pr_err("error could not get %s/%s serial-ctrl adev\n", +- serial_ctrl_hid, serial_ctrl_uid); ++ serial_ctrl_hid, serial_ctrl_uid ?: "*"); + return ERR_PTR(-ENODEV); + } + +@@ -43,7 +43,7 @@ get_serdev_controller(const char *serial + ctrl_dev = get_device(acpi_get_first_physical_node(ctrl_adev)); + if (!ctrl_dev) { + pr_err("error could not get %s/%s serial-ctrl physical node\n", +- serial_ctrl_hid, serial_ctrl_uid); ++ serial_ctrl_hid, serial_ctrl_uid ?: "*"); + ctrl_dev = ERR_PTR(-ENODEV); + goto put_ctrl_adev; + } diff --git a/queue-6.12/series b/queue-6.12/series index a4491ce37b..cfed7574e9 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -93,3 +93,6 @@ kvm-e500-always-restore-irqs.patch drm-amdgpu-fix-circular-locking-dependency-in-amdgpu.patch xfs-report-realtime-block-quota-limits-on-realtime-d.patch xfs-don-t-over-report-free-space-or-inodes-in-statvf.patch +tty-xilinx_uartps-split-sysrq-handling.patch +tty-permit-some-tiocl_setsel-modes-without-cap_sys_admin.patch +platform-x86-serdev_helpers-check-for-serial_ctrl_uid-null.patch diff --git a/queue-6.12/tty-permit-some-tiocl_setsel-modes-without-cap_sys_admin.patch b/queue-6.12/tty-permit-some-tiocl_setsel-modes-without-cap_sys_admin.patch new file mode 100644 index 0000000000..1c9c9c4962 --- /dev/null +++ b/queue-6.12/tty-permit-some-tiocl_setsel-modes-without-cap_sys_admin.patch @@ -0,0 +1,70 @@ +From 2f83e38a095f8bf7c6029883d894668b03b9bd93 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?G=C3=BCnther=20Noack?= +Date: Fri, 10 Jan 2025 14:21:22 +0000 +Subject: tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Günther Noack + +commit 2f83e38a095f8bf7c6029883d894668b03b9bd93 upstream. + +With this, processes without CAP_SYS_ADMIN are able to use TIOCLINUX with +subcode TIOCL_SETSEL, in the selection modes TIOCL_SETPOINTER, +TIOCL_SELCLEAR and TIOCL_SELMOUSEREPORT. + +TIOCL_SETSEL was previously changed to require CAP_SYS_ADMIN, as this IOCTL +let callers change the selection buffer and could be used to simulate +keypresses. These three TIOCL_SETSEL selection modes, however, are safe to +use, as they do not modify the selection buffer. + +This fixes a mouse support regression that affected Emacs (invisible mouse +cursor). + +Cc: stable +Link: https://lore.kernel.org/r/ee3ec63269b43b34e1c90dd8c9743bf8@finder.org +Fixes: 8d1b43f6a6df ("tty: Restrict access to TIOCLINUX' copy-and-paste subcommands") +Signed-off-by: Günther Noack +Reviewed-by: Kees Cook +Link: https://lore.kernel.org/r/20250110142122.1013222-1-gnoack@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/vt/selection.c | 14 ++++++++++++++ + drivers/tty/vt/vt.c | 2 -- + 2 files changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/tty/vt/selection.c ++++ b/drivers/tty/vt/selection.c +@@ -192,6 +192,20 @@ int set_selection_user(const struct tioc + if (copy_from_user(&v, sel, sizeof(*sel))) + return -EFAULT; + ++ /* ++ * TIOCL_SELCLEAR, TIOCL_SELPOINTER and TIOCL_SELMOUSEREPORT are OK to ++ * use without CAP_SYS_ADMIN as they do not modify the selection. ++ */ ++ switch (v.sel_mode) { ++ case TIOCL_SELCLEAR: ++ case TIOCL_SELPOINTER: ++ case TIOCL_SELMOUSEREPORT: ++ break; ++ default: ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ } ++ + return set_selection_kernel(&v, tty); + } + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -3345,8 +3345,6 @@ int tioclinux(struct tty_struct *tty, un + + switch (type) { + case TIOCL_SETSEL: +- if (!capable(CAP_SYS_ADMIN)) +- return -EPERM; + return set_selection_user(param, tty); + case TIOCL_PASTESEL: + if (!capable(CAP_SYS_ADMIN)) diff --git a/queue-6.12/tty-xilinx_uartps-split-sysrq-handling.patch b/queue-6.12/tty-xilinx_uartps-split-sysrq-handling.patch new file mode 100644 index 0000000000..42af72c341 --- /dev/null +++ b/queue-6.12/tty-xilinx_uartps-split-sysrq-handling.patch @@ -0,0 +1,74 @@ +From b06f388994500297bb91be60ffaf6825ecfd2afe Mon Sep 17 00:00:00 2001 +From: Sean Anderson +Date: Fri, 10 Jan 2025 16:38:22 -0500 +Subject: tty: xilinx_uartps: split sysrq handling + +From: Sean Anderson + +commit b06f388994500297bb91be60ffaf6825ecfd2afe upstream. + +lockdep detects the following circular locking dependency: + +CPU 0 CPU 1 +========================== ============================ +cdns_uart_isr() printk() + uart_port_lock(port) console_lock() + cdns_uart_console_write() + if (!port->sysrq) + uart_port_lock(port) + uart_handle_break() + port->sysrq = ... + uart_handle_sysrq_char() + printk() + console_lock() + +The fixed commit attempts to avoid this situation by only taking the +port lock in cdns_uart_console_write if port->sysrq unset. However, if +(as shown above) cdns_uart_console_write runs before port->sysrq is set, +then it will try to take the port lock anyway. This may result in a +deadlock. + +Fix this by splitting sysrq handling into two parts. We use the prepare +helper under the port lock and defer handling until we release the lock. + +Fixes: 74ea66d4ca06 ("tty: xuartps: Improve sysrq handling") +Signed-off-by: Sean Anderson +Cc: stable@vger.kernel.org # c980248179d: serial: xilinx_uartps: Use port lock wrappers +Acked-by: John Ogness +Link: https://lore.kernel.org/r/20250110213822.2107462-1-sean.anderson@linux.dev +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/xilinx_uartps.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -287,7 +287,7 @@ static void cdns_uart_handle_rx(void *de + continue; + } + +- if (uart_handle_sysrq_char(port, data)) ++ if (uart_prepare_sysrq_char(port, data)) + continue; + + if (is_rxbs_support) { +@@ -495,7 +495,7 @@ static irqreturn_t cdns_uart_isr(int irq + !(readl(port->membase + CDNS_UART_CR) & CDNS_UART_CR_RX_DIS)) + cdns_uart_handle_rx(dev_id, isrstatus); + +- uart_port_unlock(port); ++ uart_unlock_and_check_sysrq(port); + return IRQ_HANDLED; + } + +@@ -1380,9 +1380,7 @@ static void cdns_uart_console_write(stru + unsigned int imr, ctrl; + int locked = 1; + +- if (port->sysrq) +- locked = 0; +- else if (oops_in_progress) ++ if (oops_in_progress) + locked = uart_port_trylock_irqsave(port, &flags); + else + uart_port_lock_irqsave(port, &flags);