From nobody Sun Jun 14 06:12:57 2026 Received: from out162-62-57-87.mail.qq.com (out162-62-57-87.mail.qq.com [162.62.57.87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3FF431FC7 for ; Sat, 2 May 2026 19:46:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.87 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777751189; cv=none; b=Waa0wmnOL5ADUJ7eb64qiOLyfB/vuftNXssg8sngGyV27MmzfKpLsCaCUPT+DUiWwgz/iNKeNj76OQo5q2H+Cf8DmGH7ZbQ8Fh5uJm+k0N0k3DERv8/b1j9Gy0nwxpEqFiCv8owIkd/7zgWsBHSwFbcPiJcMpyD18uPPL7P6lvI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777751189; c=relaxed/simple; bh=It44M+8WsiQwpLaTKJLXu47IiCvInqE/LwLLspMY5BI=; h=Message-ID:From:To:Cc:Subject:Date:MIME-Version; b=L1aIyRfSs30pSthVgnw03Hi7RRW00YWQ7CzL1079JARM655/MrS85Ix8lyEHhzhhlCUrWz4DG4P+M+Ihu+yMNkjNRdShdSQg0HSabYjFxgSkHGswhpaE+clgLsEZlzmWKFaFwiMVCUNS8CMlstd3GNmP1WVm/rYWrHTd6wR009c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=K2LgBJ0J; arc=none smtp.client-ip=162.62.57.87 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="K2LgBJ0J" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1777751181; bh=6TDsSE9FkCGH84yZJILJMO/80ZvkOt1CAaVH0sGYw7Y=; h=From:To:Cc:Subject:Date; b=K2LgBJ0JH5Cz4+vV13vcnppNbW0E+7eL2aC8XksG4LdxCF3/PJzEPJsgD9wbRqVoT wyEzhuJeR1PB6Im7TxdCqO204qw//FsLkPDry5FjgJHZOYiaQLFl1o6YTk+ljMcAyT ocQNi3ZXu4cHiwha+kDWCVvk3rTkqPXN+yOOrP10= Received: from Lang.smartont.net ([2409:8a44:2312:14e1:56d8:1e1e:3f0b:d0f3]) by newxmesmtplogicsvrszb43-0.qq.com (NewEsmtp) with SMTP id B922DAC1; Sun, 03 May 2026 03:46:18 +0800 X-QQ-mid: xmsmtpt1777751178te1ieebfs Message-ID: X-QQ-XMAILINFO: M1rD3f8svNzn347iVFquuJ8BKcrAMLUcTv8Zc78nAnCu2chRcBllEzw6Q5EAQv uVEGeiKE6m8br84Ir9bUw7oKR0P76N1iS24MShaYoM4imXXLaHw3NXtH2b4+PaZK+VhTONTHOlmX /uftjjWc/KhbMV9V6EBv4C5H4ZXIQpitjCmxZvTZgYcQHWL7VRAPJouACMnZf6Fq271/5xhdBlDq Jqcc1bewG4cGeahXkb5xe9gt5nLZVMoUqDZnM5RaF9L5syu00h/Q8UCOtGLPJCdMN7Wg09cHBhAM 9nM81O3hToqttp+YQRu2Csz0zhojkQYqz0UE1gb3YpHYf23jcSmYA7cM11XBX3DrEkojlfUhZndi TCI1A55LPgwgOmW9UozKm8fyfSBoxsaBQJhLVfgybFyXefvdKmoRByd8SvP5fNT01Km245G73ALe vgOIY0p866Lj5FYYu4AeATnzhAc7Ai0OFbUN8RhgwFYNhHP5Eu/IM/Na7z7U3P4lE2Q2zNR9Jiyh JypR+BButkDiTHqUaHY2XCdLacd0jbEDBXFxjDE6jA7Kc9qpGjwN5/JBb9lHkJmtZhATd91NNP8x Y1qYgbuRM6WX7p6K1qsbqHynC/+LpDzoRK7g6L/Bjykz1+i68/w3rXYtTgt7zi49oB9BMlt16fCt MvOOAzjHlT+2m4u1IsS7KvVJPosNaJ4VBpPux6UyKgHsJm8XRPhQtFcqDHGBTJ0/iBoupIWqDoQd 9+WIMiHvZobSprn6Wg4DvNCAmm7jvljfKtGO+wbXxuAXKEcXOmhyVXeQh3bZf4Z0A88Y7LLnyFrg D7iIXIQZtmoO3H3jl93NM07cjY6OwYkTrlEsXL6PSk0YC8A8OVNkP5BYjq8c6aego7U9p6t3Kk80 wdSuYlcMlWO5jaMsd8m5NU5ZHanH2lhGnYUur/P0r9F1KlSFsIRcBBXXtO94noD84jN4TuH9moIX na/OXwBeHmEgkSz3UCjD+H6EuKFbXaiVm79/cO1HQ2TqupJbJlZUdPbJuDz3E/eKj5uELTbHbp9F Lz5EomixJSx25TCnxopO6Ysm7Ce6QrwfOEqKs/f4jKfM+ufNuwwXRLfq+EbY68YcJtcw3Yl5rf2t hCdER4 X-QQ-XMRINFO: NyFYKkN4Ny6FuXrnB5Ye7Aabb3ujjtK+gg== From: Wang Zihan To: gregkh@linuxfoundation.org, jirislaby@kernel.org Cc: linux-kernel@vger.kernel.org, Wang Zihan Subject: [PATCH] vt: add mode validation in vt_setactivate Date: Sun, 3 May 2026 03:46:15 +0800 X-OQ-MSGID: <20260502194615.3345069-1-jiyu03@qq.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The vt_setactivate() function accepts any mode value without validation, while VT_SETMODE correctly rejects invalid values (only VT_AUTO and VT_PROCESS are valid). This allows users to set invalid mode values (e.g., 0xFF) which bypasses VT_PROCESS signal handling and causes undefined VT switching behavior. Fix this by adding the same validation as VT_SETMODE. Signed-off-by: Wang Zihan --- drivers/tty/vt/vt_ioctl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c index 28993a3d0acb..b8787283a0fa 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -596,6 +596,8 @@ static int vt_setactivate(struct vt_setactivate __user = *sa) return -EFAULT; if (vsa.console =3D=3D 0 || vsa.console > MAX_NR_CONSOLES) return -ENXIO; + if (vsa.mode.mode !=3D VT_AUTO && vsa.mode.mode !=3D VT_PROCESS) + return -EINVAL; =20 vsa.console--; vsa.console =3D array_index_nospec(vsa.console, MAX_NR_CONSOLES); --=20 2.54.0