vt: stabilize tty reference in kbd_keycode with tty_port_tty_get

kbd_keycode() reads vc->port.tty without acquiring a tty reference,
racing against con_shutdown() which clears port.tty under a different
lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference
for the duration the tty pointer is needed.

Assisted-by: AISLE:Snapshot
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260731-tty-vt-stuff-v1-1-be99b9da8e30@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index 763a3f1b7be08ac43953c7fe6083b5e19c412328..c41d850b29c6e6a4737bc881cdfa273389718f5a 100644 (file)
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -1437,7 +1437,7 @@ static void kbd_keycode(unsigned int keycode, int down, bool hw_raw)
        struct keyboard_notifier_param param = { .vc = vc, .value = keycode, .down = down };
        int rc;
 
-       tty = vc->port.tty;
+       tty = tty_port_tty_get(&vc->port);
 
        if (tty && (!tty->driver_data)) {
                /* No driver data? Strange. Okay we fix it then. */
@@ -1497,9 +1497,12 @@ static void kbd_keycode(unsigned int keycode, int down, bool hw_raw)
                 * characters get aren't echoed locally. This makes key repeat
                 * usable with slow applications and under heavy loads.
                 */
+               tty_kref_put(tty);
                return;
        }
 
+       tty_kref_put(tty);
+
        param.shift = shift_final = (shift_state | kbd->slockstate) ^ kbd->lockstate;
        param.ledstate = kbd->ledflagstate;
        key_map = key_maps[shift_final];