Skip to contentSkip to conversation

vt: NULL dereference in vt_do_kdsk_ioctl()

PATCH In review Dan Carpenter 2 participants 2 messages Mar 10, 2012

Subsystems (2)
Kernel janitors TTY layer and serial drivers
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 vt: NULL dereference in vt_do_kdsk_ioctl()

We forgot to set the "key_map" variable here, so it's still NULL. This was introduced recently in 079c9534a9 "vt:tackle kbd_table".

Signed-off-by Dan Carpenter <[email protected]>
drivers/tty/vt/keyboard.c +1 -0
index 70d0593..86dd1e3 100644
@@ -1863,6 +1863,7 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
 				return -EPERM;
 			}
 			key_maps[s] = new_map;
+			key_map = new_map;
 			key_map[0] = U(K_ALLOCATED);
 			for (j = 1; j < NR_KEYS; j++)
 				key_map[j] = U(K_HOLE);
Acked-by on v1 1/1
#1 lore raw
Quoted 10 lines · On Sat, 10 Mar 2012 11:59:23 +0300 Dan Carpenter <[email protected]>…

We forgot to set the "key_map" variable here, so it's still NULL. This was introduced recently in 079c9534a9 "vt:tackle kbd_table".

Signed-off-by Dan Carpenter <[email protected]>
drivers/tty/vt/keyboard.c +0 -0
index 70d0593..86dd1e3 100644

drivers/tty/vt/keyboard.c int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, · line 1869

Quoted 7 lines
drivers/tty/vt/keyboard.c +1 -0
@@ -1863,6 +1863,7 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
 				return -EPERM;
 			}
 			key_maps[s] = new_map;
+			key_map = new_map;
 			key_map[0] = U(K_ALLOCATED);
 			for (j = 1; j < NR_KEYS; j++)
 				key_map[j] = U(K_HOLE);

Eep I thought I got all of those. Well noted

Acked-by Alan Cox <[email protected]>