Skip to content

Commit a09e234

Browse files
committed
vc_screen: modify vcs_size() handling in vcs_read()
jira VULN-358 jira VULN-55184 cve-bf CVE-2023-3567 cve-bf CVE-2023-52973 commit-author George Kennedy <george.kennedy@oracle.com> commit 46d733d Restore the vcs_size() handling in vcs_read() to what it had been in previous version. Fixes: 226fae1 ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF") Suggested-by: Jiri Slaby <jirislaby@kernel.org> Signed-off-by: George Kennedy <george.kennedy@oracle.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit 46d733d) Signed-off-by: Marcin Wcisło <marcin.wcislo@conclusive.pl>
1 parent fa69b43 commit a09e234

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

drivers/tty/vt/vc_screen.c

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -414,10 +414,8 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
414414
*/
415415
size = vcs_size(vc, attr, uni_mode);
416416
if (size < 0) {
417-
if (read)
418-
break;
419417
ret = size;
420-
goto unlock_out;
418+
break;
421419
}
422420
if (pos >= size)
423421
break;

0 commit comments

Comments
 (0)