@@ -2050,7 +2050,7 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
unsigned char kb_func;
unsigned long flags;
char *kbs;
- int ret;
+ int ret = 0;
if (get_user(kb_func, &user_kdgkb->kb_func))
return -EFAULT;
@@ -2073,6 +2073,7 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
ret = copy_to_user(user_kdgkb->kb_string, kbs, len + 1) ?
-EFAULT : 0;
+ kfree(kbs);
break;
}
case KDSKBSENT:
@@ -2088,11 +2089,11 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
kbs = vt_kdskbsent(kbs, kb_func);
spin_unlock_irqrestore(&func_buf_lock, flags);
+ kfree(kbs);
ret = 0;
break;
}
- kfree(kbs);
return ret;
}
smatch-kchecker gives the following warnings when run on keyboard.c : vt_do_kdgkb_ioctl() error: uninitialized symbol 'kbs'. vt_do_kdgkb_ioctl() error: uninitialized symbol 'ret'. i) The 'kbs" warning was introduced by "07edff926520" : ("vt: keyboard, reorder user buffer handling in vt_do_kdgkb_ioctl") * prior 07edff926520, the scope of kbs (allocation/deallocation) was external to switch-cases. * post 07edff926520, kbs is allocated internally for each case, however the deallocation remains external. Thus, as the "fix", the scope of kbs deallocation is now made internal to each switch case. ii) The 'ret' warning is the result of "4e1404a5cd04" : ("vt: keyboard, extract and simplify vt_kdskbsent") where the "ret = 0" (right at the end) was accidentally removed. Bringing back the above in a slightly different way, by initializing ret to 0 at the start. Many thanks to the following for review of previous versions : * Pavel Skripkin <paskripkin@gmail.com> * Andy Shevchenko <andy.shevchenko@gmail.com> * Johan Hovold <johan@kernel.org> Signed-off-by: Ajay Garg <ajaygargnsit@gmail.com> --- There were discussions previously, and the current patch is the result. v1 : https://lore.kernel.org/linux-serial/YYZN30qfaKMskVwE@kroah.com/T/#t v2 : https://lore.kernel.org/linux-serial/CAHP4M8Vdj4Eb8q773BeHvsW9n6t=3n1WznuXAR4fZCNi1J6rOg@mail.gmail.com/T/#m18f45676feaba6b1f01ddd5fe607997b190ef4b9 v3 : https://lore.kernel.org/linux-serial/20211106220315.392842-1-ajaygargnsit@gmail.com/T/#u v4 : https://lore.kernel.org/linux-serial/YYjw2mRIhy1SoIb+@hovoldconsulting.com/T/#mf25ca00a93e278bbb8f0382a4f7752dc35f4aa8b Changes in v2 : * Changes as required by scripts/checkpatch.pl * Checking whether kbs is not NULL before kfree is not required, as kfree(NULL) is safe. So, dropped the check. Changes in v3 : * Using default-switch case, and setting the variables when there is no matching cmd. Changes in v4 : * Removed braces for the default switch-case. Changes in v5 : * Incorporating changes as suggested by Johan Hovold (please see v4 link). drivers/tty/vt/keyboard.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)