kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers/tty/vt
History
Dmitry Torokhov a9d39310cf tty/vt/keyboard: fix OOB access in do_compute_shiftstate() 
[ Upstream commit 510cccb5b0 ]

The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do

	sym = U(key_maps[0][k]);

with large 'k'.

To fix it we should not attempt iterating beyond smaller of NR_KEYS and
KEY_CNT.

Also while at it let's switch to for_each_set_bit() instead of open-coding
it.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
History 2016-08-07 21:58:58 -04:00
..
.gitignore TTY: move .gitignore from drivers/char/ to drivers/tty/vt/ 2010-11-05 22:18:23 -07:00
consolemap.c tty/vt: don't set font mappings on vc not supporting this 2014-11-05 20:12:02 -08:00
cp437.uni TTY: create drivers/tty/vt and move the vt code there 2010-11-05 08:16:52 -07:00
defkeymap.c_shipped TTY: create drivers/tty/vt and move the vt code there 2010-11-05 08:16:52 -07:00
defkeymap.map TTY: create drivers/tty/vt and move the vt code there 2010-11-05 08:16:52 -07:00
keyboard.c tty/vt/keyboard: fix OOB access in do_compute_shiftstate() 2016-08-07 21:58:58 -04:00
Makefile tty: vt/Makefile: set the variables to static 2013-01-15 21:52:24 -08:00
selection.c tty: Fix unsafe vt paste_selection() 2013-07-23 16:47:10 -07:00
vc_screen.c vc: switch to fixed_size_llseek() 2013-06-29 12:57:30 +04:00
vt.c tty: vt, return error when con_startup fails 2016-07-12 08:48:18 -04:00
vt_ioctl.c tty/vt: Return EBUSY if deallocating VT1 and it is busy 2013-06-17 12:37:29 -07:00