Re: Re: drivers/s390/char/keyboard.c NULL pointer reference

Heiko Carstens
2017-08-05T07:50:36Z

On Sat, Aug 05, 2017 at 09:44:45AM +0800, sohu0106 wrote:
>
>
> I don't understand a bit,My idea is
>
> in userland
>
> fd=open("tty3270",O_RDONLY)
> ...
> ret=ioctl(fd,KDGKBDIACR,NULL)
> ...
>
> then here
> drivers/s390/char/keyboard.c
> 477
> case KDGKBDIACR:
> {
> struct kbdiacrs __user *a = argp;
> struct kbdiacr diacr;
> int i;
>
> //a is NULL,a->kb_cnt will crash
> if (put_user(kbd->accent_table_size, &a->kb_cnt))

a->kb_cnt and &a->kb_cnt is not the same...