From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <linux@weissschuh.net>

Date: Mon, 20 Feb 2023 06:46:12 +0000

Subject: [PATCH] vc_screen: don't clobber return value in vcs_read

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

References: bsc#1012628

Patch-mainline: 6.2.2

Git-commit: ae3419fbac845b4d3f3a9fae4cc80c68d82cdf6e

commit ae3419fbac845b4d3f3a9fae4cc80c68d82cdf6e upstream.

Commit 226fae124b2d ("vc_screen: move load of struct vc_data pointer in

vcs_read() to avoid UAF") moved the call to vcs_vc() into the loop.

While doing this it also moved the unconditional assignment of

	ret = -ENXIO;

This unconditional assignment was valid outside the loop but within it

it clobbers the actual value of ret.

To avoid this only assign "ret = -ENXIO" when actually needed.

[ Also, the 'goto unlock_out" needs to be just a "break", so that it

  does the right thing when it exits on later iterations when partial

  success has happened - Linus ]

Reported-by: Storm Dragon <stormdragon2976@gmail.com>

Link: https://lore.kernel.org/lkml/Y%2FKS6vdql2pIsCiI@hotmail.com/

Fixes: 226fae124b2d ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF")

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>

Link: https://lore.kernel.org/lkml/64981d94-d00c-4b31-9063-43ad0a384bde@t-8ch.de/

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Jiri Slaby <jslaby@suse.cz>

---

 drivers/tty/vt/vc_screen.c | 7 ++++---

 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c

index f566eb18..71e091f8 100644

--- a/drivers/tty/vt/vc_screen.c

+++ b/drivers/tty/vt/vc_screen.c

@@ -403,10 +403,11 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)

 		unsigned int this_round, skip = 0;

 		int size;

-		ret = -ENXIO;

 		vc = vcs_vc(inode, &viewed);

-		if (!vc)

-			goto unlock_out;

+		if (!vc) {

+			ret = -ENXIO;

+			break;

+		}

 		/* Check whether we are above size each round,

 		 * as copy_to_user at the end of this loop

-- 

2.35.3