Messages in this thread | | | Date | Sat, 5 Aug 2017 09:50:36 +0200 | From | Heiko Carstens <> | Subject | Re: Re: drivers/s390/char/keyboard.c NULL pointer reference |
| |
On Sat, Aug 05, 2017 at 09:44:45AM +0800, sohu0106 wrote: > > > I don't understand a bit,My idea is > > in userland > > fd=open("tty3270",O_RDONLY) > ... > ret=ioctl(fd,KDGKBDIACR,NULL) > ... > > then here > drivers/s390/char/keyboard.c > 477 > case KDGKBDIACR: > { > struct kbdiacrs __user *a = argp; > struct kbdiacr diacr; > int i; > > //a is NULL,a->kb_cnt will crash > if (put_user(kbd->accent_table_size, &a->kb_cnt))
a->kb_cnt and &a->kb_cnt is not the same...
| |