tty/vt/keyboard: fix OOB access in do_compute_shiftstate()
authorDmitry Torokhov <dmitry.torokhov@gmail.com>
Mon, 27 Jun 2016 21:12:34 +0000 (14:12 -0700)
committerDmitry Torokhov <dmitry.torokhov@gmail.com>
Thu, 21 Jul 2016 00:50:23 +0000 (17:50 -0700)
commit510cccb5b0c8868a2b302a0ab524da7912da648b
tree3b56ec2823c7b2757d1dea1c97b3b02a4595f7c4
parente4add7b6beaff4061693d0632bc1dcb306edba10
tty/vt/keyboard: fix OOB access in do_compute_shiftstate()

The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do

sym = U(key_maps[0][k]);

with large 'k'.

To fix it we should not attempt iterating beyond smaller of NR_KEYS and
KEY_CNT.

Also while at it let's switch to for_each_set_bit() instead of open-coding
it.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
drivers/tty/vt/keyboard.c