RE: [PATCH 12/32] Blackfin arch: Fix bug using usb keyboard crashes kernel

I'm also not an expert...

But without conswitchp preset (potential fix):

During initcalls: con_init is called, and returns because of
!display_desc.

static int __init con_init(void)
{
const char *display_desc = NULL;
struct vc_data *vc;
unsigned int currcons = 0, i;

acquire_console_sem();

if (conswitchp)
display_desc = conswitchp->con_startup();
if (!display_desc) {
fg_console = 0;
release_console_sem();
return 0; // RETURNS HERE
}

--snip--

}

At this point there is no memory allocated for vc_cons[].d
A bit later vty_init calls kbd_init.

int __init vty_init(void)
{

--snip--
kbd_init();
--snip--

}

From now on events are passed to kbd_event which will then call
kbd_keycode.
I don't see where vc_cons[].d in between there is initialized.


-----Original Message-----
From: penberg@xxxxxxxxx [mailto:penberg@xxxxxxxxx] On Behalf Of Pekka
Enberg
Sent: Montag, 21. Mai 2007 14:51
To: Hennerich, Michael
Cc: Bryan Wu; torvalds@xxxxxxxxxxxxxxxxxxxx; akpm@xxxxxxxxxxxxxxxxxxxx;
linux-kernel@xxxxxxxxxxxxxxx
Subject: Re: [PATCH 12/32] Blackfin arch: Fix bug using usb keyboard
crashes kernel

On 5/21/07, Hennerich, Michael <Michael.Hennerich@xxxxxxxxxx> wrote:
With CONFIG_VT (drivers/char/vt.c) enabled and a USB HID keyboard
connected,
we were seeing bad pointer dereferences in drivers/char/keyboard.c

In function kbd_keycode vc_cons[fg_console].d was un-initialized.

On 5/21/07, Pekka Enberg <penberg@xxxxxxxxxxxxxx> wrote:
Makes sense. Please consider adding this to the changelog. Thanks.

I am not an expert on this, but I don't see how vc_cons[fg_console].d
would be uninitialized. It is always set in
drivers/char/vt.c:con_init() and drivers/char/vt.c:vc_allocate(). The
conswitchp change affects vc->vc_sw but I don't see that being used in
drivers/char/keyboard.c:kbd_keycode() except indirectly via
set_console et al.

Perhaps I am missing something here?
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages