linux-kernel - [PATCH] tty: vt: keyboard: Fix uninitialized variables in vt_do_kdgkb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250411111548.31399-1-purvayeshi550@gmail.com>
Date: Fri, 11 Apr 2025 16:45:48 +0530
From: Purva Yeshi <purvayeshi550@...il.com>
To: gregkh@...uxfoundation.org,
	jirislaby@...nel.org
Cc: tglx@...utronix.de,
	hdegoede@...hat.com,
	mingo@...nel.org,
	linux-kernel@...r.kernel.org,
	linux-serial@...r.kernel.org,
	Purva Yeshi <purvayeshi550@...il.com>
Subject: [PATCH] tty: vt: keyboard: Fix uninitialized variables in vt_do_kdgkb_ioctl

Fix Smatch-detected issue:

drivers/tty/vt/keyboard.c:2106 vt_do_kdgkb_ioctl() error:
uninitialized symbol 'kbs'.
drivers/tty/vt/keyboard.c:2108 vt_do_kdgkb_ioctl() error:
uninitialized symbol 'ret'.

Fix uninitialized variable warnings reported by Smatch in
vt_do_kdgkb_ioctl(). The variables kbs and ret were used in the kfree
and return statements without guaranteed initialization paths, leading to
potential undefined behavior or false positives during static analysis.

Initialize char *kbs to NULL and int ret to -EINVAL at declaration.
This ensures safe use of kfree(kbs) and return ret regardless of control
flow. Also add a default case in the switch to preserve fallback behavior.

Signed-off-by: Purva Yeshi <purvayeshi550@...il.com>
---
 drivers/tty/vt/keyboard.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index ae92e6a50a65..d476c2e3f3d3 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -2057,8 +2057,8 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
 {
 	unsigned char kb_func;
 	unsigned long flags;
-	char *kbs;
-	int ret;
+	char *kbs = NULL;
+	int ret = -EINVAL;

 	if (get_user(kb_func, &user_kdgkb->kb_func))
 		return -EFAULT;
@@ -2101,6 +2101,10 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)

 		ret = 0;
 		break;
+
+	default:
+		/* unknown command, ret already set to -EINVAL */
+		break;
 	}

 	kfree(kbs);
-- 
2.34.1