mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 04:47:05 +00:00
speakup: fix a segfault caused by switching consoles
commit0fc801f801
upstream. This patch fixes a segfault by adding a null check on synth in speakup_con_update(). The segfault can be reproduced as follows: - Login into a text console - Load speakup and speakup_soft modules - Remove speakup_soft - Switch to a graphics console This is caused by lack of a null check on `synth` in speakup_con_update(). Here's the sequence that causes the segfault: - When we remove the speakup_soft, synth_release() sets the synth to null. - After that, when we change the virtual console to graphics console, vt_notifier_call() is fired, which then calls speakup_con_update(). - Inside speakup_con_update() there's no null check on synth, so it calls synth_printf(). - Inside synth_printf(), synth_buffer_add() and synth_start(), both access synth, when it is null and causing a segfault. Therefore adding a null check on synth solves the issue. Fixes:2610df4148
("staging: speakup: Add pause command used on switching to graphical mode") Cc: stable <stable@kernel.org> Signed-off-by: Mushahid Hussain <mushi.shar@gmail.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://lore.kernel.org/r/20221010165720.397042-1-mushi.shar@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
93483ccacc
commit
d11e198bcf
1 changed files with 1 additions and 1 deletions
|
@ -1778,7 +1778,7 @@ static void speakup_con_update(struct vc_data *vc)
|
|||
{
|
||||
unsigned long flags;
|
||||
|
||||
if (!speakup_console[vc->vc_num] || spk_parked)
|
||||
if (!speakup_console[vc->vc_num] || spk_parked || !synth)
|
||||
return;
|
||||
if (!spin_trylock_irqsave(&speakup_info.spinlock, flags))
|
||||
/* Speakup output, discard */
|
||||
|
|
Loading…
Reference in a new issue