Dmitry Torokhov wrote:
> On Thu, Sep 03, 2009 at 05:04:57PM +0100, Alan Jenkins wrote:
>>
>>
>> - kbd = kbd_table + fg_console;
>> + kbd = kbd_table + vc->vc_num;
>>
>
> Hmm, I see more such cases there...
>
>
Oops, sorry. I think there's only one more case, it's just
embarrassingly close to the other one.
Regards
Alan
---
>From e02f5d1cd72bc0344654872278f7f8313bc9325e Mon Sep 17 00:00:00 2001
From: Alan Jenkins <alan-jenkins@xxxxxxxxxxxxxx>
Date: Sun, 30 Aug 2009 17:40:40 +0100
Subject: [PATCHv2] Input - keyboard: close race on vt-switch
A VT switch can theoretically change fg_console between
vc = vc_cons[fg_console].d
and
kbd = kbd_table + fg_console
Fix it by replacing the second fg_console with vc->vc_num.
Signed-off-by: Alan Jenkins <alan-jenkins@xxxxxxxxxxxxxx>
---
drivers/char/keyboard.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 737be95..747683f 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -1136,7 +1136,7 @@ static int emulate_raw(struct vc_data *vc, unsigned int keycode, unsigned char u
static void kbd_rawcode(unsigned char data)
{
struct vc_data *vc = vc_cons[fg_console].d;
- kbd = kbd_table + fg_console;
+ kbd = kbd_table + vc->vc_num;
if (kbd->kbdmode == VC_RAW)
put_queue(vc, data);
}
@@ -1157,7 +1157,7 @@ static void kbd_keycode(unsigned int keycode, int down, int hw_raw)
tty->driver_data = vc;
}
- kbd = kbd_table + fg_console;
+ kbd = kbd_table + vc->vc_num;
if (keycode == KEY_LEFTALT || keycode == KEY_RIGHTALT)
sysrq_alt = down ? keycode : 0;
--
1.5.4.3
--
To unsubscribe from this list: send the line "unsubscribe linux-input" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
