re: vt: add support for smput/rmput escape codes

["Colin King (gmail)" <colin.i.king@gmail.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 1679 bytes --]

Hi,

Static analysis on linux-next detected an issue with the following commit:

commit 23743ba64709a9c137c1b928f8b8e00d846af9cc
Author: Calixte Pernot <calixte.pernot@grenoble-inp.org>
Date:   Mon Aug 25 14:56:09 2025 +0200

     vt: add support for smput/rmput escape codes


The issue is as follows in drivers/tty/vt/vt.c function vc_deallocate, 
with my nodes prefixed by #####

struct vc_data *vc_deallocate(unsigned int currcons)
{
         struct vc_data *vc = NULL;    #### vc is set to null


         WARN_CONSOLE_UNLOCKED();

         if (vc_cons_allocated(currcons)) {
                 struct vt_notifier_param param;

		##### vs is only set in this if block

                 param.vc = vc = vc_cons[currcons].d;
				
			

                 atomic_notifier_call_chain(&vt_notifier_list, 
VT_DEALLOCATE, &param);
                 vcs_remove_sysfs(currcons);
                 visual_deinit(vc);
                 con_free_unimap(vc);
                 put_pid(vc->vt_pid);
                 vc_uniscr_set(vc, NULL);
                 kfree(vc->vc_screenbuf);
                 vc_cons[currcons].d = NULL;
         }

	##### vc is potentially null and being dereferenced below:

         if (vc->vc_saved_screen != NULL) {
                 kfree(vc->vc_saved_screen);
                 vc->vc_saved_screen = NULL;
         }
         return vc;
}


The issue is that vc is only set in the if (vc_cons_allocated(currcons)) 
if block, and when it is not set, we end up with a null pointer 
de-reference on the if (vc->vc_saved_screen != NULL) check.

I suggest moving that latter check into the earlier if block.

Colin

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 4901 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]