Hi, we had a user specifying 'console=tty3270' assuming that this will use the tty3270 driver from s390 as console device. However, it will try to open tty number 3270 as tty which is not what the user expected. That alone isn't really a problem, but the kernel crashes while dereferencing invalid memory with this option. I tested this with qemu on x86, and it crashes in the same way. I never worked in the tty layer, but it looks to me like there's some out-of-bound checking missing in tty_driver_lookup_tty(). If this fix is wrong or there's a better place to do that, let me know. Sven Schnelle (1): tty: fix out-of-bounds access in tty_driver_lookup_tty() drivers/tty/tty_io.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) -- 2.34.1
