Commit 5f5619a7 authored by George Kennedy's avatar George Kennedy Committed by Yi Yang
Browse files

vc_screen: modify vcs_size() handling in vcs_read() 

stable inclusion
from stable-v4.19.276
commit 61a96ad27addecaba100213c7089bf2ebd20c6e4
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVWQ
CVE: CVE-2023-52973

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=61a96ad27addecaba100213c7089bf2ebd20c6e4



--------------------------------

[ Upstream commit 46d733d0 ]

Restore the vcs_size() handling in vcs_read() to what
it had been in previous version.

Fixes: 226fae12 ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF")
Suggested-by: default avatarJiri Slaby <jirislaby@kernel.org>
Signed-off-by: default avatarGeorge Kennedy <george.kennedy@oracle.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarYi Yang <yiyang13@huawei.com>
parent 87baad75

drivers/tty/vt/vc_screen.c

+1 −3
Original line number Diff line number Diff line
@@ -277,10 +277,8 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) 
		 */

		size = vcs_size(inode);

		if (size < 0) {

			if (read)

				break;

			ret = size;

			goto unlock_out;

			break;

		}

		if (pos >= size)

			break;