From 60927aaa3efdc125fe8a3ef02c2c8e3f6d1d1a42 Mon Sep 17 00:00:00 2001 From: George Kennedy Date: Thu, 20 Jul 2023 10:32:04 +0800 Subject: [PATCH] vc_screen: modify vcs_size() handling in vcs_read() stable inclusion from stable-v5.10.173 commit 3e734e694181b27687ce17da3229aa8edfd21760 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7JRBO?from=project-issue Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3e734e694181b27687ce17da3229aa8edfd21760 -------------------------------- [ Upstream commit 46d733d0efc79bc8430d63b57ab88011806d5180 ] Restore the vcs_size() handling in vcs_read() to what it had been in previous version. Fixes: 226fae124b2d ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF") Suggested-by: Jiri Slaby Signed-off-by: George Kennedy Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin Signed-off-by: Lu Jialin --- drivers/tty/vt/vc_screen.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c index 71e091f879f0..1dc07f9214d5 100644 --- a/drivers/tty/vt/vc_screen.c +++ b/drivers/tty/vt/vc_screen.c @@ -415,10 +415,8 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) */ size = vcs_size(vc, attr, uni_mode); if (size < 0) { - if (read) - break; ret = size; - goto unlock_out; + break; } if (pos >= size) break; -- GitLab