lkml.org 
[lkml]   [2017]   [Aug]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Re: drivers/s390/char/keyboard.c NULL pointer reference
On Sat, Aug 05, 2017 at 09:44:45AM +0800, sohu0106 wrote:
>
>
> I don't understand a bit,My idea is
>
> in userland
>
> fd=open("tty3270",O_RDONLY)
> ...
> ret=ioctl(fd,KDGKBDIACR,NULL)
> ...
>
> then here
> drivers/s390/char/keyboard.c
> 477
> case KDGKBDIACR:
> {
> struct kbdiacrs __user *a = argp;
> struct kbdiacr diacr;
> int i;
>
> //a is NULL,a->kb_cnt will crash
> if (put_user(kbd->accent_table_size, &a->kb_cnt))

a->kb_cnt and &a->kb_cnt is not the same...

\
 
 \ /
  Last update: 2017-08-05 09:51    [W:0.042 / U:0.032 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site