tty/vt/keyboard: fix OOB access in do_compute_shiftstate()
The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS, which is currently 256, whereas number of keys/buttons in input device (and therefor in key_down) is much larger - KEY_CNT - 768, and that can cause out-of-bound access when we do sym = U(key_maps[0][k]); with large 'k'. To fix it we should not attempt iterating beyond smaller of NR_KEYS and KEY_CNT. Also while at it let's switch to for_each_set_bit() instead of open-coding it. Reported-by: Sasha Levin <sasha.levin@oracle.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This commit is contained in:
parent
e4add7b6be
commit
510cccb5b0
|
@ -366,34 +366,22 @@ static void to_utf8(struct vc_data *vc, uint c)
|
||||||
|
|
||||||
static void do_compute_shiftstate(void)
|
static void do_compute_shiftstate(void)
|
||||||
{
|
{
|
||||||
unsigned int i, j, k, sym, val;
|
unsigned int k, sym, val;
|
||||||
|
|
||||||
shift_state = 0;
|
shift_state = 0;
|
||||||
memset(shift_down, 0, sizeof(shift_down));
|
memset(shift_down, 0, sizeof(shift_down));
|
||||||
|
|
||||||
for (i = 0; i < ARRAY_SIZE(key_down); i++) {
|
for_each_set_bit(k, key_down, min(NR_KEYS, KEY_CNT)) {
|
||||||
|
sym = U(key_maps[0][k]);
|
||||||
if (!key_down[i])
|
if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
k = i * BITS_PER_LONG;
|
val = KVAL(sym);
|
||||||
|
if (val == KVAL(K_CAPSSHIFT))
|
||||||
|
val = KVAL(K_SHIFT);
|
||||||
|
|
||||||
for (j = 0; j < BITS_PER_LONG; j++, k++) {
|
shift_down[val]++;
|
||||||
|
shift_state |= BIT(val);
|
||||||
if (!test_bit(k, key_down))
|
|
||||||
continue;
|
|
||||||
|
|
||||||
sym = U(key_maps[0][k]);
|
|
||||||
if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK)
|
|
||||||
continue;
|
|
||||||
|
|
||||||
val = KVAL(sym);
|
|
||||||
if (val == KVAL(K_CAPSSHIFT))
|
|
||||||
val = KVAL(K_SHIFT);
|
|
||||||
|
|
||||||
shift_down[val]++;
|
|
||||||
shift_state |= (1 << val);
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue