Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1466177

[PATCH 3.12 021/100] tty/vt/keyboard: fix OOB access in do_compute_shiftstate()

Show all headers | View raw

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 510cccb5b0c8868a2b302a0ab524da7912da648b upstream.

The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do

	sym = U(key_maps[0][k]);

with large 'k'.

To fix it we should not attempt iterating beyond smaller of NR_KEYS and
KEY_CNT.

Also while at it let's switch to for_each_set_bit() instead of open-coding
it.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/tty/vt/keyboard.c | 30 +++++++++---------------------
 1 file changed, 9 insertions(+), 21 deletions(-)

diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index d0e3a4497707..adf4d3124cc6 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -365,34 +365,22 @@ static void to_utf8(struct vc_data *vc, uint c)
 
 static void do_compute_shiftstate(void)
 {
-	unsigned int i, j, k, sym, val;
+	unsigned int k, sym, val;
 
 	shift_state = 0;
 	memset(shift_down, 0, sizeof(shift_down));
 
-	for (i = 0; i < ARRAY_SIZE(key_down); i++) {
-
-		if (!key_down[i])
+	for_each_set_bit(k, key_down, min(NR_KEYS, KEY_CNT)) {
+		sym = U(key_maps[0][k]);
+		if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK)
 			continue;
 
-		k = i * BITS_PER_LONG;
-
-		for (j = 0; j < BITS_PER_LONG; j++, k++) {
-
-			if (!test_bit(k, key_down))
-				continue;
+		val = KVAL(sym);
+		if (val == KVAL(K_CAPSSHIFT))
+			val = KVAL(K_SHIFT);
 
-			sym = U(key_maps[0][k]);
-			if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK)
-				continue;
-
-			val = KVAL(sym);
-			if (val == KVAL(K_CAPSSHIFT))
-				val = KVAL(K_SHIFT);
-
-			shift_down[val]++;
-			shift_state |= (1 << val);
-		}
+		shift_down[val]++;
+		shift_state |= BIT(val);
 	}
 }
 
-- 
2.9.3

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.12 000/100] 3.12.63-stable review Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:20 +0200
  [PATCH 3.12 001/100] x86/mm: Add barriers and document switch_mm()-vs-flush synchronization Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 002/100] mm: migrate dirty page without clear_page_dirty_for_io etc Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 004/100] printk: do cond_resched() between lines while outputting to consoles Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
  [PATCH 3.12 009/100] libceph: set 'exists' flag for newly up osd Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 024/100] ALSA: ctl: Stop notification after disconnection Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 021/100] tty/vt/keyboard: fix OOB access in do_compute_shiftstate() Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 015/100] iio: Fix error handling in iio_trigger_attach_poll_func Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 020/100] iio:ad7266: Fix probe deferral for vref Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 011/100] kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 025/100] scsi: fix race between simultaneous decrements of ->host_failed Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 022/100] ALSA: dummy: Fix a use-after-free at closing Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 023/100] ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift() Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 016/100] staging: iio: accel: fix error check Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
    [PATCH 3.12 026/100] Fix reconnect to not defer smb3 session reconnect long after socket reconnect Jiri Slaby <jslaby@suse.cz> - 2016-08-19 09:40 +0200
  [PATCH 3.12 009/101] netfilter: x_tables: speed up jump target validation Jiri Slaby <jslaby@suse.cz> - 2016-08-19 10:00 +0200
  Re: [PATCH 3.12 000/100] 3.12.63-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-19 21:10 +0200

csiph-web