From: Greg KH on
2.6.32-stable review patch. If anyone has any objections, please let us know.


From: Henrique de Moraes Holschuh <hmh(a)>

commit b525c06cdbd8a3963f0173ccd23f9147d4c384b5 upstream.

Given the right combination of ThinkPad and, just reading the
video output control state is enough to hard-crash

Until the day I somehow find out a model or BIOS cut date to not
provide this feature to ThinkPads that can do video switching through
X RandR, change permissions so that only processes with CAP_SYS_ADMIN
can access any sort of video output control state.

This bug could be considered a local DoS I suppose, as it allows any
non-privledged local user to cause some versions of to
hard-crash some ThinkPads.

Reported-by: Jidanni <jidanni(a)>
Signed-off-by: Henrique de Moraes Holschuh <hmh(a)>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)>

Documentation/laptops/thinkpad-acpi.txt | 4 ++++
drivers/platform/x86/Kconfig | 10 ++++++++--
drivers/platform/x86/thinkpad_acpi.c | 15 +++++++++++++--
3 files changed, 25 insertions(+), 4 deletions(-)

--- a/Documentation/laptops/thinkpad-acpi.txt
+++ b/Documentation/laptops/thinkpad-acpi.txt
@@ -650,6 +650,10 @@ LCD, CRT or DVI (if available). The foll
echo expand_toggle > /proc/acpi/ibm/video
echo video_switch > /proc/acpi/ibm/video

+NOTE: Access to this feature is restricted to processes owning the
+CAP_SYS_ADMIN capability for safety reasons, as it can interact badly
+enough with some versions of to crash it.
Each video output device can be enabled or disabled individually.
Reading /proc/acpi/ibm/video shows the status of each device.

--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -291,9 +291,15 @@ config THINKPAD_ACPI_VIDEO
server running, phase of the moon, and the current mood of
Schroedinger's cat. If you can use's RandR to control
your ThinkPad's video output ports instead of this feature,
- don't think twice: do it and say N here to save some memory.
+ don't think twice: do it and say N here to save memory and avoid
+ bad interactions with

- If you are not sure, say Y here.
+ NOTE: access to this feature is limited to processes with the
+ CAP_SYS_ADMIN capability, to avoid local DoS issues in platforms
+ where it interacts badly with
+ If you are not sure, say Y here but do try to check if you could
+ be using RandR instead.

bool "Support NVRAM polling for hot keys"
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -281,6 +281,7 @@ struct ibm_init_struct {
char param[32];

int (*init) (struct ibm_init_struct *);
+ mode_t base_procfs_mode;
struct ibm_struct *data;

@@ -4620,6 +4621,10 @@ static int video_read(struct seq_file *m
return 0;

+ /* Even reads can crash, so... */
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
status = video_outputsw_get();
if (status < 0)
return status;
@@ -4653,6 +4658,10 @@ static int video_write(char *buf)
if (video_supported == TPACPI_VIDEO_NONE)
return -ENODEV;

+ /* Even reads can crash, let alone writes... */
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
enable = 0;
disable = 0;

@@ -7887,9 +7896,10 @@ static int __init ibm_init(struct ibm_in
"%s installed\n", ibm->name);

if (ibm->read) {
- mode_t mode;
+ mode_t mode = iibm->base_procfs_mode;

- mode = S_IRUGO;
+ if (!mode)
+ mode = S_IRUGO;
if (ibm->write)
mode |= S_IWUSR;
entry = proc_create_data(ibm->name, mode, proc_dir,
@@ -8080,6 +8090,7 @@ static struct ibm_init_struct ibms_init[
.init = video_init,
+ .base_procfs_mode = S_IRUSR,
.data = &video_driver_data,

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)
More majordomo info at
Please read the FAQ at