[PATCH] vt: keyboard: add NULL check for vc_cons[fg_console].d in kbd_keycode and kbd_rawcode

[PATCH] vt: keyboard: add NULL check for vc_cons[fg_console].d in kbd_keycode and kbd_rawcode

[Daniel Hodges]

kbd_keycode() and kbd_rawcode() dereference vc_cons[fg_console].d
without checking if it is NULL. The foreground console should normally
always be allocated, but there could be a time during console setup or
teardown where this pointer could be NULL, leading to a general
protection fault.

Syzkaller triggers this by injecting USB HID input events that reach
kbd_event() while the console state may not be fully consistent. The crash
manifests as a null-ptr-deref in __queue_work when put_queue() or
puts_queue() calls tty_flip_buffer_push() on the uninitialized vc port.

Add a NULL check for vc at the start of both kbd_rawcode() and
kbd_keycode() to bail out early if the foreground console is not allocated.

Reported-by: syzbot+c3693b491545af43db87@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c3693b491545af43db87
Reported-by: syzbot+03f79366754268a0f20c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=03f79366754268a0f20c
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Daniel Hodges <git@danielhodges.dev>
---
 drivers/tty/vt/keyboard.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index a2116e135a82..975830013d24 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -1389,6 +1389,9 @@ static void kbd_rawcode(unsigned char data)
 {
 	struct vc_data *vc = vc_cons[fg_console].d;
 
+	if (!vc)
+		return;
+
 	kbd = &kbd_table[vc->vc_num];
 	if (kbd->kbdmode == VC_RAW)
 		put_queue(vc, data);
@@ -1405,6 +1408,9 @@ static void kbd_keycode(unsigned int keycode, int down, bool hw_raw)
 	struct keyboard_notifier_param param = { .vc = vc, .value = keycode, .down = down };
 	int rc;
 
+	if (!vc)
+		return;
+
 	tty = vc->port.tty;
 
 	if (tty && (!tty->driver_data)) {
-- 
2.52.0

Re: [PATCH] vt: keyboard: add NULL check for vc_cons[fg_console].d in kbd_keycode and kbd_rawcode

[Greg Kroah-Hartman]

On Sat, Feb 07, 2026 at 07:31:12PM -0500, Daniel Hodges wrote:
> kbd_keycode() and kbd_rawcode() dereference vc_cons[fg_console].d
> without checking if it is NULL. The foreground console should normally
> always be allocated, but there could be a time during console setup or
> teardown where this pointer could be NULL, leading to a general
> protection fault.
> 
> Syzkaller triggers this by injecting USB HID input events that reach
> kbd_event() while the console state may not be fully consistent. The crash
> manifests as a null-ptr-deref in __queue_work when put_queue() or
> puts_queue() calls tty_flip_buffer_push() on the uninitialized vc port.
> 
> Add a NULL check for vc at the start of both kbd_rawcode() and
> kbd_keycode() to bail out early if the foreground console is not allocated.
> 
> Reported-by: syzbot+c3693b491545af43db87@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c3693b491545af43db87
> Reported-by: syzbot+03f79366754268a0f20c@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=03f79366754268a0f20c
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Daniel Hodges <git@danielhodges.dev>
> ---
>  drivers/tty/vt/keyboard.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
> index a2116e135a82..975830013d24 100644
> --- a/drivers/tty/vt/keyboard.c
> +++ b/drivers/tty/vt/keyboard.c
> @@ -1389,6 +1389,9 @@ static void kbd_rawcode(unsigned char data)
>  {
>  	struct vc_data *vc = vc_cons[fg_console].d;
>  
> +	if (!vc)
> +		return;
> +

What prevents vc from being NULL right after checking this?



>  	kbd = &kbd_table[vc->vc_num];
>  	if (kbd->kbdmode == VC_RAW)
>  		put_queue(vc, data);
> @@ -1405,6 +1408,9 @@ static void kbd_keycode(unsigned int keycode, int down, bool hw_raw)
>  	struct keyboard_notifier_param param = { .vc = vc, .value = keycode, .down = down };
>  	int rc;
>  
> +	if (!vc)
> +		return;

Same here, where is the locking?

thanks,

greg k-h

Re: [PATCH] vt: keyboard: add NULL check for vc_cons[fg_console].d in kbd_keycode and kbd_rawcode

[Daniel Hodges]

On Thu, Mar 12, 2026 at 03:22:09PM +0100, Greg Kroah-Hartman wrote:
> On Sat, Feb 07, 2026 at 07:31:12PM -0500, Daniel Hodges wrote:
> > kbd_keycode() and kbd_rawcode() dereference vc_cons[fg_console].d
> > without checking if it is NULL. The foreground console should normally
> > always be allocated, but there could be a time during console setup or
> > teardown where this pointer could be NULL, leading to a general
> > protection fault.
> > 
> > Syzkaller triggers this by injecting USB HID input events that reach
> > kbd_event() while the console state may not be fully consistent. The crash
> > manifests as a null-ptr-deref in __queue_work when put_queue() or
> > puts_queue() calls tty_flip_buffer_push() on the uninitialized vc port.
> > 
> > Add a NULL check for vc at the start of both kbd_rawcode() and
> > kbd_keycode() to bail out early if the foreground console is not allocated.
> > 
> > Reported-by: syzbot+c3693b491545af43db87@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=c3693b491545af43db87
> > Reported-by: syzbot+03f79366754268a0f20c@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=03f79366754268a0f20c
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > Signed-off-by: Daniel Hodges <git@danielhodges.dev>
> > ---
> >  drivers/tty/vt/keyboard.c | 6 ++++++
> >  1 file changed, 6 insertions(+)
> > 
> > diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
> > index a2116e135a82..975830013d24 100644
> > --- a/drivers/tty/vt/keyboard.c
> > +++ b/drivers/tty/vt/keyboard.c
> > @@ -1389,6 +1389,9 @@ static void kbd_rawcode(unsigned char data)
> >  {
> >  	struct vc_data *vc = vc_cons[fg_console].d;
> >  
> > +	if (!vc)
> > +		return;
> > +
> 
> What prevents vc from being NULL right after checking this?

Yeah, your right about that. I spent a bit of time to make a reproducer
using a kernel module and I think if RCU is used on vc_cons[].d it
should then be properly protected. Let me know if that sounds like a
reasonable approach and I can send a v2.

> 
> 
> 
> >  	kbd = &kbd_table[vc->vc_num];
> >  	if (kbd->kbdmode == VC_RAW)
> >  		put_queue(vc, data);
> > @@ -1405,6 +1408,9 @@ static void kbd_keycode(unsigned int keycode, int down, bool hw_raw)
> >  	struct keyboard_notifier_param param = { .vc = vc, .value = keycode, .down = down };
> >  	int rc;
> >  
> > +	if (!vc)
> > +		return;
> 
> Same here, where is the locking?
> 
> thanks,
> 
> greg k-h

Same as above if this is protected with RCU I think that should work
properly.

-Daniel