Patch "gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     gpiolib-cdev-disallow-reconfiguration-without-direct.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 986a28ee8b0b800a76e50fb85d0ebc41abdff9f3
Author: Kent Gibson <warthog618@xxxxxxxxx>
Date:   Wed Jun 26 13:29:22 2024 +0800

    gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
    
    [ Upstream commit 9919cce62f68e6ab68dc2a975b5dc670f8ca7d40 ]
    
    linehandle_set_config() behaves badly when direction is not set.
    The configuration validation is borrowed from linehandle_create(), where,
    to verify the intent of the user, the direction must be set to in order
    to effect a change to the electrical configuration of a line. But, when
    applied to reconfiguration, that validation does not allow for the unset
    direction case, making it possible to clear flags set previously without
    specifying the line direction.
    
    Adding to the inconsistency, those changes are not immediately applied by
    linehandle_set_config(), but will take effect when the line value is next
    get or set.
    
    For example, by requesting a configuration with no flags set, an output
    line with GPIOHANDLE_REQUEST_ACTIVE_LOW and GPIOHANDLE_REQUEST_OPEN_DRAIN
    requested could have those flags cleared, inverting the sense of the line
    and changing the line drive to push-pull on the next line value set.
    
    Ensure the intent of the user by disallowing configurations which do not
    have direction set, returning an error to userspace to indicate that the
    configuration is invalid.
    
    And, for clarity, use lflags, a local copy of gcnf.flags, throughout when
    dealing with the requested flags, rather than a mixture of both.
    
    Fixes: e588bb1eae31 ("gpio: add new SET_CONFIG ioctl() to gpio chardev")
    Signed-off-by: Kent Gibson <warthog618@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20240626052925.174272-2-warthog618@xxxxxxxxx
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
index b4b71e68b90de..d526a4c91e82e 100644
--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c
@@ -132,6 +132,10 @@ struct linehandle_state {
 	GPIOHANDLE_REQUEST_OPEN_DRAIN | \
 	GPIOHANDLE_REQUEST_OPEN_SOURCE)
 
+#define GPIOHANDLE_REQUEST_DIRECTION_FLAGS \
+	(GPIOHANDLE_REQUEST_INPUT | \
+	 GPIOHANDLE_REQUEST_OUTPUT)
+
 static int linehandle_validate_flags(u32 flags)
 {
 	/* Return an error if an unknown flag is set */
@@ -212,21 +216,21 @@ static long linehandle_set_config(struct linehandle_state *lh,
 	if (ret)
 		return ret;
 
+	/* Lines must be reconfigured explicitly as input or output. */
+	if (!(lflags & GPIOHANDLE_REQUEST_DIRECTION_FLAGS))
+		return -EINVAL;
+
 	for (i = 0; i < lh->num_descs; i++) {
 		desc = lh->descs[i];
-		linehandle_flags_to_desc_flags(gcnf.flags, &desc->flags);
+		linehandle_flags_to_desc_flags(lflags, &desc->flags);
 
-		/*
-		 * Lines have to be requested explicitly for input
-		 * or output, else the line will be treated "as is".
-		 */
 		if (lflags & GPIOHANDLE_REQUEST_OUTPUT) {
 			int val = !!gcnf.default_values[i];
 
 			ret = gpiod_direction_output(desc, val);
 			if (ret)
 				return ret;
-		} else if (lflags & GPIOHANDLE_REQUEST_INPUT) {
+		} else {
 			ret = gpiod_direction_input(desc);
 			if (ret)
 				return ret;