* [PATCH] tty: vt: keyboard: fix general protection fault in k_meta
@ 2026-02-07 19:27 Soham Kute
2026-03-12 13:51 ` Greg KH
0 siblings, 1 reply; 2+ messages in thread
From: Soham Kute @ 2026-02-07 19:27 UTC (permalink / raw)
To: gregkh, jirislaby
Cc: linux-serial, linux-kernel, Soham Kute,
syzbot+03f79366754268a0f20c
syzbot reported a general protection fault in k_meta() caused by
dereferencing an invalid keyboard pointer when checking META mode.
Add a defensive check to ensure the keyboard pointer is valid before
calling vc_kbd_mode().
Reported-by: syzbot+03f79366754268a0f20c@syzkaller.appspotmail.com
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/tty/vt/keyboard.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index d65fc60dd..b535d7a42 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -880,7 +880,7 @@ static void k_meta(struct vc_data *vc, unsigned char value, char up_flag)
if (up_flag)
return;
- if (vc_kbd_mode(kbd, VC_META)) {
+ if (kbd && vc_kbd_mode(kbd, VC_META)) {
put_queue(vc, '\033');
put_queue(vc, value);
} else
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] tty: vt: keyboard: fix general protection fault in k_meta
2026-02-07 19:27 [PATCH] tty: vt: keyboard: fix general protection fault in k_meta Soham Kute
@ 2026-03-12 13:51 ` Greg KH
0 siblings, 0 replies; 2+ messages in thread
From: Greg KH @ 2026-03-12 13:51 UTC (permalink / raw)
To: Soham Kute
Cc: jirislaby, linux-serial, linux-kernel,
syzbot+03f79366754268a0f20c
On Sun, Feb 08, 2026 at 12:57:08AM +0530, Soham Kute wrote:
> syzbot reported a general protection fault in k_meta() caused by
> dereferencing an invalid keyboard pointer when checking META mode.
>
> Add a defensive check to ensure the keyboard pointer is valid before
> calling vc_kbd_mode().
How can kbd be NULL here? What causes that to happen?
>
> Reported-by: syzbot+03f79366754268a0f20c@syzkaller.appspotmail.com
>
> Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
> ---
> drivers/tty/vt/keyboard.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
> index d65fc60dd..b535d7a42 100644
> --- a/drivers/tty/vt/keyboard.c
> +++ b/drivers/tty/vt/keyboard.c
> @@ -880,7 +880,7 @@ static void k_meta(struct vc_data *vc, unsigned char value, char up_flag)
> if (up_flag)
> return;
>
> - if (vc_kbd_mode(kbd, VC_META)) {
> + if (kbd && vc_kbd_mode(kbd, VC_META)) {
What prevents kbd from being NULL _right_ after you check it? There's
no locking here at all...
Perhaps fix the root problem here?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-03-12 13:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-07 19:27 [PATCH] tty: vt: keyboard: fix general protection fault in k_meta Soham Kute
2026-03-12 13:51 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox