Keycodes arrive from the shared ring the backend writes: if (test_bit(key->keycode, info->ptr->keybit)) { dev = info->ptr; } else if (test_bit(key->keycode, info->kbd->keybit)) { ... } else { pr_warn("unhandled keycode 0x%x\n", key->keycode); return; } The keycode is a plain u32 from the ring page, while the keybit bitmaps it is tested against are sized for the KEY_CNT keycode bits declared to the input core. A backend that sends a keycode at or above KEY_CNT makes test_bit() read past the bitmap to decide which device gets the event, and no keycode at or above KEY_MAX is a valid EV_KEY code in the first place. Ignore keycodes the bitmaps cannot hold. Fixes: 4ee36dc08e5c ("xen pvfb: Para-virtual framebuffer, keyboard and pointer driver") Cc: stable@vger.kernel.org Signed-off-by: Guo Zihao --- drivers/input/misc/xen-kbdfront.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/input/misc/xen-kbdfront.c b/drivers/input/misc/xen-kbdfront.c index 6471d836f..e9092a788 100644 --- a/drivers/input/misc/xen-kbdfront.c +++ b/drivers/input/misc/xen-kbdfront.c @@ -92,6 +92,11 @@ static void xenkbd_handle_key_event(struct xenkbd_info *info, struct input_dev *dev; int value = key->pressed; + if (key->keycode >= KEY_MAX) { + pr_warn("unhandled keycode 0x%x\n", key->keycode); + return; + } + if (test_bit(key->keycode, info->ptr->keybit)) { dev = info->ptr; } else if (test_bit(key->keycode, info->kbd->keybit)) { -- 2.50.1