linux-kernel - Re: vt: add support for smput/rmput escape codes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <51222649-6f41-4030-baaa-7b98b241de98@kernel.org>
Date: Wed, 10 Sep 2025 08:41:31 +0200
From: Jiri Slaby <jirislaby@...nel.org>
To: "Colin King (gmail)" <colin.i.king@...il.com>,
 Calixte Pernot <calixte.pernot@...noble-inp.org>,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: vt: add support for smput/rmput escape codes

On 09. 09. 25, 21:15, Colin King (gmail) wrote:
> Hi,
> 
> Static analysis on linux-next detected an issue with the following commit:
> 
> commit 23743ba64709a9c137c1b928f8b8e00d846af9cc
> Author: Calixte Pernot <calixte.pernot@...noble-inp.org>
> Date:   Mon Aug 25 14:56:09 2025 +0200
> 
>      vt: add support for smput/rmput escape codes
> 
> 
> The issue is as follows in drivers/tty/vt/vt.c function vc_deallocate, 
> with my nodes prefixed by #####
> 
> struct vc_data *vc_deallocate(unsigned int currcons)
> {
...
>      ##### vc is potentially null and being dereferenced below:
> 
>          if (vc->vc_saved_screen != NULL) {
>                  kfree(vc->vc_saved_screen);
>                  vc->vc_saved_screen = NULL;
>          }
>          return vc;
> }
> 
> 
> The issue is that vc is only set in the if (vc_cons_allocated(currcons)) 
> if block, and when it is not set, we end up with a null pointer de- 
> reference on the if (vc->vc_saved_screen != NULL) check.
> 
> I suggest moving that latter check into the earlier if block.

Agreed:
https://lore.kernel.org/all/tencent_CAD45DB31906CF890DBB25AB0DED12205D07@qq.com/

thanks,
-- 
js
suse labs