Skip to content

Commit aa92d48

Browse files
vc_screen: modify vcs_size() handling in vcs_read()
jira VULN-8820 cve-bf CVE-2023-3567 commit-author George Kennedy <george.kennedy@oracle.com> commit 46d733d Restore the vcs_size() handling in vcs_read() to what it had been in previous version. Fixes: 226fae1 ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF") Suggested-by: Jiri Slaby <jirislaby@kernel.org> Signed-off-by: George Kennedy <george.kennedy@oracle.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit 46d733d) Signed-off-by: Shreeya Patel <spatel@ciq.com>
1 parent 57126ff commit aa92d48

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

drivers/tty/vt/vc_screen.c

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -415,10 +415,8 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
415415
*/
416416
size = vcs_size(vc, attr, uni_mode);
417417
if (size < 0) {
418-
if (read)
419-
break;
420418
ret = size;
421-
goto unlock_out;
419+
break;
422420
}
423421
if (pos >= size)
424422
break;

0 commit comments

Comments
 (0)