kernel/git/next/linux-next.git/drivers/accessibility/speakup/keyhelp.c, branch stable

speakup: keyhelp: guard letter_offsets possible out-of-range indexing

2026-07-17T12:54:55+00:00

help_init() builds letter_offsets[] by using the first byte of each function name as an index via `(start & 31) - 1`. If function_names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write. Function names can be overridden with the following commands as root: modprobe speakup_soft echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names # then press Insert+2 on /dev/tty This fix checks the first letter in help_init(), and if it is not in the [a–z] range the function returns an error to the caller. Eventually this error is propagated to drivers/accessibility/speakup/main.c:2217, which causes a bleep sound. Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory") Signed-off-by: Pavel Zhigulin Signed-off-by: Samuel Thibault Link: https://patch.msgid.link/20260531230804.254962-10-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman

speakup: Standardize character attribute types to u16

2026-07-17T12:54:55+00:00

This change replaces non-portable `u_short` types with standardized `u16` throughout the speakup subsystem to ensure: 1. Consistent 16-bit width across all architectures. 2. Improved code portability and readability. 3. Elimination of platform-dependent type sizes. 4. Safe bitwise operations without sign-extension risks. Signed-off-by: Jagadeesh Yalapalli Signed-off-by: Samuel Thibault Reviewed-by: Samuel Thibault Link: https://patch.msgid.link/20260531230804.254962-8-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman

staging/speakup: Move out of staging

2020-07-29T12:02:41+00:00

The nasty TODO items are done. Signed-off-by: Samuel Thibault Link: https://lore.kernel.org/r/20200729003531.907370-1-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman