Commit 8ab6d6ee authored by George Kennedy's avatar George Kennedy Committed by openeuler-sync-bot
Browse files

vc_screen: modify vcs_size() handling in vcs_read() 

stable inclusion
from stable-v5.10.173
commit 3e734e694181b27687ce17da3229aa8edfd21760
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7JRBO?from=project-issue

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3e734e694181b27687ce17da3229aa8edfd21760



--------------------------------

[ Upstream commit 46d733d0 ]

Restore the vcs_size() handling in vcs_read() to what
it had been in previous version.

Fixes: 226fae12 ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF")
Suggested-by: default avatarJiri Slaby <jirislaby@kernel.org>
Signed-off-by: default avatarGeorge Kennedy <george.kennedy@oracle.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLu Jialin <lujialin4@huawei.com>
(cherry picked from commit 60927aaa)
parent f0d46146

drivers/tty/vt/vc_screen.c

+1 −3
Original line number Diff line number Diff line
@@ -415,10 +415,8 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) 
		 */

		size = vcs_size(vc, attr, uni_mode);

		if (size < 0) {

			if (read)

				break;

			ret = size;

			goto unlock_out;

			break;

		}

		if (pos >= size)

			break;