提交 60927aaa 编写于 作者: G George Kennedy 提交者: Lu Jialin

vc_screen: modify vcs_size() handling in vcs_read()

stable inclusion
from stable-v5.10.173
commit 3e734e694181b27687ce17da3229aa8edfd21760
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7JRBO?from=project-issue

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3e734e694181b27687ce17da3229aa8edfd21760

--------------------------------

[ Upstream commit 46d733d0 ]

Restore the vcs_size() handling in vcs_read() to what
it had been in previous version.

Fixes: 226fae12 ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF")
Suggested-by: NJiri Slaby <jirislaby@kernel.org>
Signed-off-by: NGeorge Kennedy <george.kennedy@oracle.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: NLu Jialin <lujialin4@huawei.com>
上级 bbfa62b2
......@@ -415,10 +415,8 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
*/
size = vcs_size(vc, attr, uni_mode);
if (size < 0) {
if (read)
break;
ret = size;
goto unlock_out;
break;
}
if (pos >= size)
break;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册