Dmitry Torokhov 7d091e02c9 tty/vt/keyboard: fix OOB access in do_compute_shiftstate() ...

commit 510cccb5b0c8868a2b302a0ab524da7912da648b upstream.

The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do

	sym = U(key_maps[0][k]);

with large 'k'.

To fix it we should not attempt iterating beyond smaller of NR_KEYS and
KEY_CNT.

Also while at it let's switch to for_each_set_bit() instead of open-coding
it.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2016-07-27 09:47:37 -07:00

..

hvc

Merge tag 'tty-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2015-11-04 21:35:12 -08:00

ipwireless

…

serial

QE-UART: add "fsl,t1040-ucc-uart" to of_device_id

2016-06-07 18:14:35 -07:00

vt

tty/vt/keyboard: fix OOB access in do_compute_shiftstate()

2016-07-27 09:47:37 -07:00

amiserial.c

…

bfin_jtag_comm.c

…

cyclades.c

tty: Remove ASYNC_CLOSING checks in open()/hangup() methods

2015-10-17 21:11:29 -07:00

ehv_bytechan.c

…

goldfish.c

…

isicom.c

…

Kconfig

…

Makefile

…

metag_da.c

…

mips_ejtag_fdc.c

ttyFDC: Fix build problems due to use of module_{init,exit}

2015-10-17 21:29:21 -07:00

moxa.c

…

moxa.h

…

mxser.c

…

mxser.h

…

n_gsm.c

TTY: n_gsm, fix false positive WARN_ON

2016-06-01 12:15:52 -07:00

n_hdlc.c

Fix OpenSSH pty regression on close

2016-06-01 12:15:52 -07:00

n_r3964.c

tty: r3964: Replace/remove bogus tty lock use

2015-10-17 21:11:29 -07:00

n_tracerouter.c

n_tracerouter: stop including <asm-generic/bug>

2015-10-15 00:21:10 +02:00

n_tracesink.c

n_tracesink: stop including <asm-generic/bug>

2015-10-15 00:21:11 +02:00

n_tracesink.h

…

n_tty.c

Fix OpenSSH pty regression on close

2016-06-01 12:15:52 -07:00

nozomi.c

…

pty.c

Fix OpenSSH pty regression on close

2016-06-01 12:15:52 -07:00

rocket_int.h

…

rocket.c

tty: Remove tty_port::close_wait

2015-10-17 21:11:29 -07:00

rocket.h

…

synclink_gt.c

tty: Remove ASYNC_CLOSING checks in open()/hangup() methods

2015-10-17 21:11:29 -07:00

synclink.c

tty: synclink, fix indentation

2015-10-17 21:14:06 -07:00

synclinkmp.c

tty: Remove ASYNC_CLOSING checks in open()/hangup() methods

2015-10-17 21:11:29 -07:00

sysrq.c

…

tty_audit.c

tty: audit: Fix audit source

2015-11-20 16:19:54 -08:00

tty_buffer.c

Fix OpenSSH pty regression on close

2016-06-01 12:15:52 -07:00

tty_io.c

tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)

2016-02-17 12:31:02 -08:00

tty_ioctl.c

tty: Fix tty_send_xchar() lock order inversion

2015-11-20 16:19:54 -08:00

tty_ldisc.c

tty: Fix direct use of tty buffer work

2015-11-20 16:19:54 -08:00

tty_ldsem.c

…

tty_mutex.c

tty: Wait interruptibly for tty lock on reopen

2016-02-17 12:31:02 -08:00

tty_port.c

tty: Abstract tty buffer work

2015-10-17 21:32:21 -07:00