)]}' { "commit": "510cccb5b0c8868a2b302a0ab524da7912da648b", "tree": "3b56ec2823c7b2757d1dea1c97b3b02a4595f7c4", "parents": [ "e4add7b6beaff4061693d0632bc1dcb306edba10" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Jun 27 14:12:34 2016 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Wed Jul 20 17:50:23 2016 -0700" }, "message": "tty/vt/keyboard: fix OOB access in do_compute_shiftstate()\n\nThe size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,\nwhich is currently 256, whereas number of keys/buttons in input device (and\ntherefor in key_down) is much larger - KEY_CNT - 768, and that can cause\nout-of-bound access when we do\n\n\tsym \u003d U(key_maps[0][k]);\n\nwith large \u0027k\u0027.\n\nTo fix it we should not attempt iterating beyond smaller of NR_KEYS and\nKEY_CNT.\n\nAlso while at it let\u0027s switch to for_each_set_bit() instead of open-coding\nit.\n\nReported-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nReviewed-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "f973bfce5d089256086b945fb37148fffebf902d", "old_mode": 33188, "old_path": "drivers/tty/vt/keyboard.c", "new_id": "1e93a37e27f05091c6ade07f2798a514c55ae2b8", "new_mode": 33188, "new_path": "drivers/tty/vt/keyboard.c" } ] }