| Message ID | 1675704844-17228-1-git-send-email-george.kennedy@oracle.com |
|---|---|
| State | New |
| Headers | show |
| Series | vc_screen: break from vcs_read() while loop if vcs_vc() returns NULL | expand |
diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c index f566eb1839dc..29288401cf9e 100644 --- a/drivers/tty/vt/vc_screen.c +++ b/drivers/tty/vt/vc_screen.c @@ -403,10 +403,13 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) unsigned int this_round, skip = 0; int size; - ret = -ENXIO; vc = vcs_vc(inode, &viewed); - if (!vc) + if (!vc) { + if (read) + break; + ret = -ENXIO; goto unlock_out; + } /* Check whether we are above size each round, * as copy_to_user at the end of this loop
If vcs_vc() returns NULL in vcs_read(), break if partial read, else if no reads have been done, go to unlock_out and return ENXIO. Fixes: 226fae124b2d ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF") Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: George Kennedy <george.kennedy@oracle.com> --- drivers/tty/vt/vc_screen.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)