tty/vt/keyboard: fix OOB access in do_compute_shiftstate()

The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do

	sym = U(key_maps[0][k]);

with large 'k'.

To fix it we should not attempt iterating beyond smaller of NR_KEYS and

Also while at it let's switch to for_each_set_bit() instead of open-coding

Reported-by: Sasha Levin <>
Reviewed-by: Guenter Roeck <>
Signed-off-by: Dmitry Torokhov <>
1 file changed