KDGETLED reaches getledstate() and samples ledstate without serializing
against keyboard_tasklet.

That is problematic because kbd_bh() temporarily stores ~leds into
ledstate during a VT switch to force LED propagation before committing
the final value.  An unlocked KDGETLED can therefore observe that
internal sentinel instead of the last committed LED state.

Other ledstate readers in this file already quiesce keyboard_tasklet
before sampling the value.  Do the same in getledstate() so the ioctl
only returns a stable snapshot.

Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
 drivers/tty/vt/keyboard.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index 13bc048f45e86..671ad4a5cb64c 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -1127,7 +1127,13 @@ static void kbd_init_leds(void)
  */
 static unsigned char getledstate(void)
 {
-	return ledstate & 0xff;
+	unsigned char leds;
+
+	tasklet_disable(&keyboard_tasklet);
+	leds = ledstate & 0xff;
+	tasklet_enable(&keyboard_tasklet);
+
+	return leds;
 }
 
 void setledstate(struct kbd_struct *kb, unsigned int led)
-- 
2.43.0