Received: by 2002:a05:6358:489b:b0:bb:da1:e618 with SMTP id x27csp271256rwn; Thu, 8 Sep 2022 01:02:53 -0700 (PDT) X-Google-Smtp-Source: AA6agR6JmD+huzMAkXgH27NpI5swjCES0lIR/6O+q0qUzL71BXei+AE6YhXexDnZJCgFX9XWoP9A X-Received: by 2002:a05:6402:5212:b0:446:6910:5549 with SMTP id s18-20020a056402521200b0044669105549mr6120050edd.345.1662624172735; Thu, 08 Sep 2022 01:02:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1662624172; cv=none; d=google.com; s=arc-20160816; b=fFXOeykgfM+kaImENdcYS7gjwp0Cu5pOcSQNtL/N1s5oxDLKsWkhfRr4KGL1rIuKzg KmFu9lAxc49NLdz368sOS1Sq30mCfJirewrqa91UmtRtLpxz5blr9ZAL0VWPjvdXkPRB ecW7Ntz3EHvVDk8vZJvCdg8iXmhIZg/hidxTo1xIi5ERd9gJBnLqQSAlRIEFQtxOLKQc VkuHQHHaz4gIaCR5S/gDQSedukVRKotZiYbwVkOkYkEQ9ILW0U0jq38jTZ5DNcfhjLu/ RwPBPa2yzhDUcubwnJdjWlCXCRP/WNVVSEJFed+koH87KcC9DCxVXesY9xs0RB7Fj61S 9yKg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=pEOR3JQfJb5bAPqeJhsVSKPLNxiI0x8dqxgcBgGfmAU=; b=iIy4mJ+lm+z24Ac6/J/SGdq9wRWXOyNiNB/nBWR1eGACm3xyWB5JOs+bLRo2HJsZjg 4R0jsjE8YKMie/d4/eiQgbvQZmjahN7+KWnoMYwYWhmNRDdzOturtRuGDaJGzq0ttUFq JQwANDd/NXLxKUnMmtA1Qcqbxc601JeD/zmlVhYR9FiHYRGXZuR1QS9yrWBueb/stFmR MpSZ9lkUvCDzQ37rPg/9+bKmCj80nw20jURta1T2YgDCaYQ9kS4pBzsy2+uxh6XC/0wm gFQjjl4I20Qm7h+z3at2mdt4ZmE+pHngvb3Mu5Du7fN7gQeh7QNel0lsWtsG6mAE7rkx rISw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=FfIeBUvG; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id g9-20020a1709067c4900b0072b66c5cdf0si1348940ejp.481.2022.09.08.01.02.17; Thu, 08 Sep 2022 01:02:52 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=FfIeBUvG; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229776AbiIHHyn (ORCPT + 99 others); Thu, 8 Sep 2022 03:54:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55414 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229535AbiIHHyk (ORCPT ); Thu, 8 Sep 2022 03:54:40 -0400 Received: from mail-pl1-x643.google.com (mail-pl1-x643.google.com [IPv6:2607:f8b0:4864:20::643]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7651E12088 for ; Thu, 8 Sep 2022 00:54:36 -0700 (PDT) Received: by mail-pl1-x643.google.com with SMTP id v1so3693694plo.9 for ; Thu, 08 Sep 2022 00:54:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date; bh=pEOR3JQfJb5bAPqeJhsVSKPLNxiI0x8dqxgcBgGfmAU=; b=FfIeBUvGG2WNrNe83MK1XhRJXFwdDcmvpoRqWFo/VCsIPohCH2Y+hImPYno85UavFM vbPrdI05cQLetYdvy//D/xOnEdk500ZYf5pfjSBnxxfAUq0tVgPVn1ES2atXkPmspuMp XYSY4bXLijVG/J/DK8qeNSwbu0/gcfb8nNo2JmTyP2njmqiVdmM8sylBaaK81A18qnaG OuzWpdNQAaCIve2qn1WGi2JYl58DcsJx/Ki2ciR+WHuvFcc9vEfBkMHBVdXj6Uoy7Se8 DwEm5O5TcOAOJz9XabFQ1LABHCcUPr0ShzeU+dHdJgRX4PPTzd0zGtMqoQdzR+TIdED6 wr8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date; bh=pEOR3JQfJb5bAPqeJhsVSKPLNxiI0x8dqxgcBgGfmAU=; b=0fJt2CRin0tj687kDFmcVIv5WOUnP3ZHWs/tqmVAUlannJi4knqFN73VTWWSdfKJRw 9abiNcPUCh2sV49w51MRSVAaQmn8yfgqqreV66QMTSWED8jMIy7Mrgakm8LtIIviNmgL H1LI6+ZaBEEEBpW+A4AHsYj7tGJn+p4RADDmgK1T7GPjO/blvYncu+UC+hAA702OWaYJ tSnwXzEwFJoihDHN/T5Y1CjcBYgZ//6iilHlBv272bbAdGmGjla6Yrij0kxDv1bij7Ii rleTaoMwd6nBbS4ulHzUH7amt0eZhwgiUN0KZq8sM+ur7Jg8ZzOmvEPk6FD+PxpVNcv+ YrAQ== X-Gm-Message-State: ACgBeo34+cF340/dtaAKN1cjG5VC5LNBkBzOuyMQevCVwrHz689c/dnu s4M39CWFrogJBOaEbxTZaAA5bbAusTU0ozg2XpI= X-Received: by 2002:a17:90b:390e:b0:202:5d4e:c1f2 with SMTP id ob14-20020a17090b390e00b002025d4ec1f2mr2842543pjb.45.1662623675847; Thu, 08 Sep 2022 00:54:35 -0700 (PDT) Received: from hbh25y.. ([129.227.150.140]) by smtp.gmail.com with ESMTPSA id y1-20020a623201000000b0053b850b17c8sm11645952pfy.152.2022.09.08.00.54.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 08 Sep 2022 00:54:35 -0700 (PDT) From: Hangyu Hua To: gregkh@linuxfoundation.org, jirislaby@kernel.org, changlianzhi@uniontech.com, dmitry.torokhov@gmail.com Cc: linux-kernel@vger.kernel.org, Hangyu Hua Subject: [PATCH] tty: vt: add a bounds checking in vt_do_kdgkb_ioctl() Date: Thu, 8 Sep 2022 15:54:03 +0800 Message-Id: <20220908075403.27930-1-hbh25y@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org As array_index_nospec's comments indicateļ¼Œa bounds checking need to add before calling array_index_nospec. Signed-off-by: Hangyu Hua --- drivers/tty/vt/keyboard.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index be8313cdbac3..b9845455df79 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -2067,6 +2067,9 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) if (get_user(kb_func, &user_kdgkb->kb_func)) return -EFAULT; + if (kb_func >= MAX_NR_FUNC) + return -EFAULT; + kb_func = array_index_nospec(kb_func, MAX_NR_FUNC); switch (cmd) { -- 2.34.1