Re: vt: add support for smput/rmput escape codes

[Jiri Slaby <jirislaby@kernel.org>]

On 09. 09. 25, 21:15, Colin King (gmail) wrote:
> Hi,
> 
> Static analysis on linux-next detected an issue with the following commit:
> 
> commit 23743ba64709a9c137c1b928f8b8e00d846af9cc
> Author: Calixte Pernot <calixte.pernot@grenoble-inp.org>
> Date:   Mon Aug 25 14:56:09 2025 +0200
> 
>      vt: add support for smput/rmput escape codes
> 
> 
> The issue is as follows in drivers/tty/vt/vt.c function vc_deallocate, 
> with my nodes prefixed by #####
> 
> struct vc_data *vc_deallocate(unsigned int currcons)
> {
...
>      ##### vc is potentially null and being dereferenced below:
> 
>          if (vc->vc_saved_screen != NULL) {
>                  kfree(vc->vc_saved_screen);
>                  vc->vc_saved_screen = NULL;
>          }
>          return vc;
> }
> 
> 
> The issue is that vc is only set in the if (vc_cons_allocated(currcons)) 
> if block, and when it is not set, we end up with a null pointer de- 
> reference on the if (vc->vc_saved_screen != NULL) check.
> 
> I suggest moving that latter check into the earlier if block.

Agreed:
https://lore.kernel.org/all/tencent_CAD45DB31906CF890DBB25AB0DED12205D07@qq.com/

thanks,
-- 
js
suse labs