Re: [PATCH] vt: keyboard: add NULL check for vc_cons[fg_console].d in kbd_keycode and kbd_rawcode

Daniel Hodges
2026-03-13T18:54:15Z

On Thu, Mar 12, 2026 at 03:22:09PM +0100, Greg Kroah-Hartman wrote:
> On Sat, Feb 07, 2026 at 07:31:12PM -0500, Daniel Hodges wrote:
> > kbd_keycode() and kbd_rawcode() dereference vc_cons[fg_console].d
> > without checking if it is NULL. The foreground console should normally
> > always be allocated, but there could be a time during console setup or
> > teardown where this pointer could be NULL, leading to a general
> > protection fault.
> >
> > Syzkaller triggers this by injecting USB HID input events that reach
> > kbd_event() while the console state may not be fully consistent. The crash
> > manifests as a null-ptr-deref in __queue_work when put_queue() or
> > puts_queue() calls tty_flip_buffer_push() on the uninitialized vc port.
> >
> > Add a NULL check for vc at the start of both kbd_rawcode() and
> > kbd_keycode() to bail out early if the foreground console is not allocated.
> >
> > Reported-by: syzbot+c3693b491545af43db87@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=c3693b491545af43db87
> > Reported-by: syzbot+03f79366754268a0f20c@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=03f79366754268a0f20c
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > Signed-off-by: Daniel Hodges <git@danielhodges.dev>
> > ---
> > drivers/tty/vt/keyboard.c | 6 ++++++
> > 1 file changed, 6 insertions(+)
> >
> > diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
> > index a2116e135a82..975830013d24 100644
> > --- a/drivers/tty/vt/keyboard.c
> > +++ b/drivers/tty/vt/keyboard.c
> > @@ -1389,6 +1389,9 @@ static void kbd_rawcode(unsigned char data)
> > {
> > struct vc_data *vc = vc_cons[fg_console].d;
> >
> > + if (!vc)
> > + return;
> > +
>
> What prevents vc from being NULL right after checking this?

Yeah, your right about that. I spent a bit of time to make a reproducer
using a kernel module and I think if RCU is used on vc_cons[].d it
should then be properly protected. Let me know if that sounds like a
reasonable approach and I can send a v2.

>
>
>
> > kbd = &kbd_table[vc->vc_num];
> > if (kbd->kbdmode == VC_RAW)
> > put_queue(vc, data);
> > @@ -1405,6 +1408,9 @@ static void kbd_keycode(unsigned int keycode, int down, bool hw_raw)
> > struct keyboard_notifier_param param = { .vc = vc, .value = keycode, .down = down };
> > int rc;
> >
> > + if (!vc)
> > + return;
>
> Same here, where is the locking?
>
> thanks,
>
> greg k-h

Same as above if this is protected with RCU I think that should work
properly.

-Daniel