[PATCH] fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace

[Daniel Vetter]

This is an oversight from dc5bdb68b5b3 ("drm/fb-helper: Fix vt
restore") - I failed to realize that nasty userspace could set this.

It's not pretty to mix up kernel-internal and userspace uapi flags
like this, but since the entire fb_var_screeninfo structure is uapi
we'd need to either add a new parameter to the ->fb_set_par callback
and fb_set_par() function, which has a _lot_ of users. Or some other
fairly ugly side-channel int fb_info. Neither is a pretty prospect.

Instead just correct the issue at hand by filtering out this
kernel-internal flag in the ioctl handling code.

Signed-off-by: Daniel Vetter <daniel.vetter at intel.com>
Fixes: dc5bdb68b5b3 ("drm/fb-helper: Fix vt restore")
Cc: Alex Deucher <alexander.deucher at amd.com>
Cc: shlomo at fastmail.com
Cc: Michel Dänzer <michel at daenzer.net>
Cc: Noralf Trønnes <noralf at tronnes.org>
Cc: Thomas Zimmermann <tzimmermann at suse.de>
Cc: Daniel Vetter <daniel.vetter at intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst at linux.intel.com>
Cc: Maxime Ripard <mripard at kernel.org>
Cc: David Airlie <airlied at linux.ie>
Cc: Daniel Vetter <daniel at ffwll.ch>
Cc: dri-devel at lists.freedesktop.org
Cc: <stable at vger.kernel.org> # v5.7+
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie at samsung.com>
Cc: Geert Uytterhoeven <geert at linux-m68k.org>
Cc: Nathan Chancellor <natechancellor at gmail.com>
Cc: Qiujun Huang <hqjagain at gmail.com>
Cc: Peter Rosin <peda at axentia.se>
Cc: linux-fbdev at vger.kernel.org
Cc: Helge Deller <deller at gmx.de>
Cc: Sam Ravnborg <sam at ravnborg.org>
Cc: Geert Uytterhoeven <geert+renesas at glider.be>
Cc: Samuel Thibault <samuel.thibault at ens-lyon.org>
Cc: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
Cc: Shigeru Yoshida <syoshida at redhat.com>
---
 drivers/video/fbdev/core/fbmem.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 875541ff185b..3fd95a79e4c3 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -1116,6 +1116,8 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
 	case FBIOPUT_VSCREENINFO:
 		if (copy_from_user(&var, argp, sizeof(var)))
 			return -EFAULT;
+		/* only for kernel-internal use */
+		var.activate &= ~FB_ACTIVATE_KD_TEXT;
 		console_lock();
 		lock_fb_info(info);
 		ret = fbcon_modechange_possible(info, &var);
-- 
2.40.0