drivers/s390/char/keyboard.c NULL pointer reference

From	sohu0106 <sohu0106@126.com>
Newsgroups	linux.kernel
Subject	drivers/s390/char/keyboard.c NULL pointer reference
Date	2017-08-03 16:00 +0200
Message-ID	<uaoPn-Jx-7@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw


Local users able to send the NULL arg argument to kbd_ioctl(), which could cause kernel crash




diff --git a/keyboard.c 
b/keyboard.c
index ba0e4f9..3ec16b1 100644
--- a/keyboard.c
+++ b/keyboard.c
@@ -456,6 +456,8 @@ int kbd_ioctl(struct kbd_data *kbd, unsigned int cmd, unsigned long arg)
        int perm;
 
        argp = (void __user *)arg;
+       if( !argp )
+               return -EFAULT;
 
        /*
         * To have permissions to do most of the vt ioctls, we either have


https://bugzilla.kernel.org/show_bug.cgi?id=196575

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

drivers/s390/char/keyboard.c NULL pointer reference sohu0106 <sohu0106@126.com> - 2017-08-03 16:00 +0200
  Re: drivers/s390/char/keyboard.c NULL pointer reference Heiko Carstens <heiko.carstens@de.ibm.com> - 2017-08-04 11:30 +0200
    Re:Re: drivers/s390/char/keyboard.c NULL pointer reference sohu0106 <sohu0106@126.com> - 2017-08-05 03:50 +0200
      Re: Re: drivers/s390/char/keyboard.c NULL pointer reference Heiko Carstens <heiko.carstens@de.ibm.com> - 2017-08-05 10:00 +0200

csiph-web