Skip to content

Commit a09e234

Browse files
committed
vc_screen: modify vcs_size() handling in vcs_read()
jira VULN-358 jira VULN-55184 cve-bf CVE-2023-3567 cve-bf CVE-2023-52973 commit-author George Kennedy <[email protected]> commit 46d733d Restore the vcs_size() handling in vcs_read() to what it had been in previous version. Fixes: 226fae1 ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF") Suggested-by: Jiri Slaby <[email protected]> Signed-off-by: George Kennedy <[email protected]> Signed-off-by: Linus Torvalds <[email protected]> (cherry picked from commit 46d733d) Signed-off-by: Marcin Wcisło <[email protected]>
1 parent fa69b43 commit a09e234

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

drivers/tty/vt/vc_screen.c

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -414,10 +414,8 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
414414
*/
415415
size = vcs_size(vc, attr, uni_mode);
416416
if (size < 0) {
417-
if (read)
418-
break;
419417
ret = size;
420-
goto unlock_out;
418+
break;
421419
}
422420
if (pos >= size)
423421
break;

0 commit comments

Comments
 (0)