From fc7b924d9c69c45fed11316a4233358bbba1ead7 Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Mar 03 2023 11:25:15 +0000
Subject: vc_screen: don't clobber return value in vcs_read (bsc#1012628).


---

diff --git a/patches.kernel.org/6.2.2-004-vc_screen-don-t-clobber-return-value-in-vcs_rea.patch b/patches.kernel.org/6.2.2-004-vc_screen-don-t-clobber-return-value-in-vcs_rea.patch
new file mode 100644
index 0000000..82647cc
--- /dev/null
+++ b/patches.kernel.org/6.2.2-004-vc_screen-don-t-clobber-return-value-in-vcs_rea.patch
@@ -0,0 +1,62 @@
+From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <linux@weissschuh.net>
+Date: Mon, 20 Feb 2023 06:46:12 +0000
+Subject: [PATCH] vc_screen: don't clobber return value in vcs_read
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bsc#1012628
+Patch-mainline: 6.2.2
+Git-commit: ae3419fbac845b4d3f3a9fae4cc80c68d82cdf6e
+
+commit ae3419fbac845b4d3f3a9fae4cc80c68d82cdf6e upstream.
+
+Commit 226fae124b2d ("vc_screen: move load of struct vc_data pointer in
+vcs_read() to avoid UAF") moved the call to vcs_vc() into the loop.
+
+While doing this it also moved the unconditional assignment of
+
+	ret = -ENXIO;
+
+This unconditional assignment was valid outside the loop but within it
+it clobbers the actual value of ret.
+
+To avoid this only assign "ret = -ENXIO" when actually needed.
+
+[ Also, the 'goto unlock_out" needs to be just a "break", so that it
+  does the right thing when it exits on later iterations when partial
+  success has happened - Linus ]
+
+Reported-by: Storm Dragon <stormdragon2976@gmail.com>
+Link: https://lore.kernel.org/lkml/Y%2FKS6vdql2pIsCiI@hotmail.com/
+Fixes: 226fae124b2d ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF")
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Link: https://lore.kernel.org/lkml/64981d94-d00c-4b31-9063-43ad0a384bde@t-8ch.de/
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/vt/vc_screen.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
+index f566eb18..71e091f8 100644
+--- a/drivers/tty/vt/vc_screen.c
++++ b/drivers/tty/vt/vc_screen.c
+@@ -403,10 +403,11 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+ 		unsigned int this_round, skip = 0;
+ 		int size;
+ 
+-		ret = -ENXIO;
+ 		vc = vcs_vc(inode, &viewed);
+-		if (!vc)
+-			goto unlock_out;
++		if (!vc) {
++			ret = -ENXIO;
++			break;
++		}
+ 
+ 		/* Check whether we are above size each round,
+ 		 * as copy_to_user at the end of this loop
+-- 
+2.35.3
+
diff --git a/series.conf b/series.conf
index 6b771f7..5d27c3b 100644
--- a/series.conf
+++ b/series.conf
@@ -43,6 +43,7 @@
 	patches.kernel.org/6.2.2-001-ALSA-hda-cs35l41-Correct-error-condition-handli.patch
 	patches.kernel.org/6.2.2-002-crypto-arm64-sm4-gcm-Fix-possible-crash-in-GCM-.patch
 	patches.kernel.org/6.2.2-003-bpf-bpf_fib_lookup-should-not-return-neigh-in-N.patch
+	patches.kernel.org/6.2.2-004-vc_screen-don-t-clobber-return-value-in-vcs_rea.patch
 
 	########################################################
 	# Build fixes that apply to the vanilla kernel too.