[PATCH] tty: vt: keyboard: fix general protection fault in k_meta

[PATCH] tty: vt: keyboard: fix general protection fault in k_meta

[Soham Kute]

syzbot reported a general protection fault in k_meta() caused by
dereferencing an invalid keyboard pointer when checking META mode.

Add a defensive check to ensure the keyboard pointer is valid before
calling vc_kbd_mode().

Reported-by: syzbot+03f79366754268a0f20c@syzkaller.appspotmail.com

Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
 drivers/tty/vt/keyboard.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index d65fc60dd..b535d7a42 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -880,7 +880,7 @@ static void k_meta(struct vc_data *vc, unsigned char value, char up_flag)
 	if (up_flag)
 		return;
 
-	if (vc_kbd_mode(kbd, VC_META)) {
+	if (kbd && vc_kbd_mode(kbd, VC_META)) {
 		put_queue(vc, '\033');
 		put_queue(vc, value);
 	} else
-- 
2.34.1

Re: [PATCH] tty: vt: keyboard: fix general protection fault in k_meta

[Greg KH]

On Sun, Feb 08, 2026 at 12:57:08AM +0530, Soham Kute wrote:
> syzbot reported a general protection fault in k_meta() caused by
> dereferencing an invalid keyboard pointer when checking META mode.
> 
> Add a defensive check to ensure the keyboard pointer is valid before
> calling vc_kbd_mode().

How can kbd be NULL here?  What causes that to happen?

> 
> Reported-by: syzbot+03f79366754268a0f20c@syzkaller.appspotmail.com
> 
> Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
> ---
>  drivers/tty/vt/keyboard.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
> index d65fc60dd..b535d7a42 100644
> --- a/drivers/tty/vt/keyboard.c
> +++ b/drivers/tty/vt/keyboard.c
> @@ -880,7 +880,7 @@ static void k_meta(struct vc_data *vc, unsigned char value, char up_flag)
>  	if (up_flag)
>  		return;
>  
> -	if (vc_kbd_mode(kbd, VC_META)) {
> +	if (kbd && vc_kbd_mode(kbd, VC_META)) {

What prevents kbd from being NULL _right_ after you check it?  There's
no locking here at all...

Perhaps fix the root problem here?

thanks,

greg k-h