[PATCH] Input - keyboard: fix theoretical race on vt switch

[PATCH] Input - keyboard: fix theoretical race on vt switch

[Alan Jenkins]

Switching virtual consoles could change fg_console between

	vc = vc_cons[fg_console].d
and
	kbd = kbd_table + fg_console

Replace the second instance of fg_console with vc->vc_num.

Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
---
 drivers/char/keyboard.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 737be95..4b564c5 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -1157,7 +1157,7 @@ static void kbd_keycode(unsigned int keycode, int down, int hw_raw)
 		tty->driver_data = vc;
 	}
 
-	kbd = kbd_table + fg_console;
+	kbd = kbd_table + vc->vc_num;
 
 	if (keycode == KEY_LEFTALT || keycode == KEY_RIGHTALT)
 		sysrq_alt = down ? keycode : 0;
-- 
1.6.3.2

Re: [PATCH] Input - keyboard: fix theoretical race on vt switch

[Dmitry Torokhov]

On Thu, Sep 03, 2009 at 05:04:57PM +0100, Alan Jenkins wrote:
> Switching virtual consoles could change fg_console between
> 
> 	vc = vc_cons[fg_console].d
> and
> 	kbd = kbd_table + fg_console
> 
> Replace the second instance of fg_console with vc->vc_num.
> 
> Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
> ---
>  drivers/char/keyboard.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
> index 737be95..4b564c5 100644
> --- a/drivers/char/keyboard.c
> +++ b/drivers/char/keyboard.c
> @@ -1157,7 +1157,7 @@ static void kbd_keycode(unsigned int keycode, int down, int hw_raw)
>  		tty->driver_data = vc;
>  	}
>  
> -	kbd = kbd_table + fg_console;
> +	kbd = kbd_table + vc->vc_num;

Hmm, I see more such cases there...

-- 
Dmitry

[PATCHv2] Input - keyboard: fix theoretical race on vt switch

[Alan Jenkins]

Dmitry Torokhov wrote:
> On Thu, Sep 03, 2009 at 05:04:57PM +0100, Alan Jenkins wrote:
>>
>>  
>> -	kbd = kbd_table + fg_console;
>> +	kbd = kbd_table + vc->vc_num;
>>     
>
> Hmm, I see more such cases there...
>
>   

Oops, sorry.  I think there's only one more case, it's just
embarrassingly close to the other one.

Regards
Alan

---

>From e02f5d1cd72bc0344654872278f7f8313bc9325e Mon Sep 17 00:00:00 2001
From: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
Date: Sun, 30 Aug 2009 17:40:40 +0100
Subject: [PATCHv2] Input - keyboard: close race on vt-switch

A VT switch can theoretically change fg_console between

	vc = vc_cons[fg_console].d
and
	kbd = kbd_table + fg_console

Fix it by replacing the second fg_console with vc->vc_num.

Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
---
 drivers/char/keyboard.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 737be95..747683f 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -1136,7 +1136,7 @@ static int emulate_raw(struct vc_data *vc, unsigned int keycode, unsigned char u
 static void kbd_rawcode(unsigned char data)
 {
 	struct vc_data *vc = vc_cons[fg_console].d;
-	kbd = kbd_table + fg_console;
+	kbd = kbd_table + vc->vc_num;
 	if (kbd->kbdmode == VC_RAW)
 		put_queue(vc, data);
 }
@@ -1157,7 +1157,7 @@ static void kbd_keycode(unsigned int keycode, int down, int hw_raw)
 		tty->driver_data = vc;
 	}
 
-	kbd = kbd_table + fg_console;
+	kbd = kbd_table + vc->vc_num;
 
 	if (keycode == KEY_LEFTALT || keycode == KEY_RIGHTALT)
 		sysrq_alt = down ? keycode : 0;
-- 
1.5.4.3