[PATCHv2] Input - keyboard: fix theoretical race on vt switch

Commit Message

Alan Jenkins Sept. 5, 2009, 2:16 p.m. UTC

Dmitry Torokhov wrote:
> On Thu, Sep 03, 2009 at 05:04:57PM +0100, Alan Jenkins wrote:
>>
>>  
>> -	kbd = kbd_table + fg_console;
>> +	kbd = kbd_table + vc->vc_num;
>>     
>
> Hmm, I see more such cases there...
>
>   

Oops, sorry.  I think there's only one more case, it's just
embarrassingly close to the other one.

Regards
Alan

---

From e02f5d1cd72bc0344654872278f7f8313bc9325e Mon Sep 17 00:00:00 2001
From: Alan Jenkins <[e-mail]>
Date: Sun, 30 Aug 2009 17:40:40 +0100
Subject: [PATCHv2] Input - keyboard: close race on vt-switch

A VT switch can theoretically change fg_console between

	vc = vc_cons[fg_console].d
and
	kbd = kbd_table + fg_console

Fix it by replacing the second fg_console with vc->vc_num.

Signed-off-by: Alan Jenkins <[e-mail]>
---
 drivers/char/keyboard.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

Patch

diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 737be95..747683f 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -1136,7 +1136,7 @@  static int emulate_raw(struct vc_data *vc, unsigned int keycode, unsigned char u
 static void kbd_rawcode(unsigned char data)
 {
 	struct vc_data *vc = vc_cons[fg_console].d;
-	kbd = kbd_table + fg_console;
+	kbd = kbd_table + vc->vc_num;
 	if (kbd->kbdmode == VC_RAW)
 		put_queue(vc, data);
 }
@@ -1157,7 +1157,7 @@  static void kbd_keycode(unsigned int keycode, int down, int hw_raw)
 		tty->driver_data = vc;
 	}
 
-	kbd = kbd_table + fg_console;
+	kbd = kbd_table + vc->vc_num;
 
 	if (keycode == KEY_LEFTALT || keycode == KEY_RIGHTALT)
 		sysrq_alt = down ? keycode : 0;