Date:   Tue, 28 Feb 2023 01:45:56 +0000
From:   linux@weissschuh.net
To:     George Kennedy <george.kennedy@oracle.com>
Cc:     jirislaby@kernel.org, gregkh@linuxfoundation.org,
        torvalds@linux-foundation.org, sfr@canb.auug.org.au,
        akpm@linux-foundation.org, linux-kernel@vger.kernel.org,
        linux-serial@vger.kernel.org, regressions@lists.linux.dev
Subject: Re: [PATCH v2] vc_screen: modify vcs_size() handling in vcs_read()
Message-ID: <face2b1b-0f2e-4a79-a71b-79681fc56273@t-8ch.de>
References: <1677529301-19530-1-git-send-email-george.kennedy@oracle.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1677529301-19530-1-git-send-email-george.kennedy@oracle.com>
Precedence: bulk

Hi,

On Mon, Feb 27, 2023 at 03:21:41PM -0500, George Kennedy wrote:
> Restore the vcs_size() handling in vcs_read() to what
> it had been in previous version.

This still seems to be broken for me.

Testcase:

# cat /dev/vcsa1
[.. data, looks complete ..]
cat: /dev/vcsa1: No such device or address

"ret" is still unconditionally overwritten with -ENXIO at the beginning
of the loop.
And when we break the loop because everything has been read in
`if (pos >= size)` then this error is returned to userspace instead of
just `0`.

I still need the patch from 

https://lore.kernel.org/lkml/20230220064612.1783-1-linux@weissschuh.net/

> Fixes: 226fae124b2d ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF")
> Suggested-by: Jiri Slaby <jirislaby@kernel.org>
> Signed-off-by: George Kennedy <george.kennedy@oracle.com>
> ---
> v2: added Fixes
> 
>  drivers/tty/vt/vc_screen.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
> index f566eb1839dc..c0a2273bb998 100644
> --- a/drivers/tty/vt/vc_screen.c
> +++ b/drivers/tty/vt/vc_screen.c
> @@ -414,10 +414,8 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
>  		 */
>  		size = vcs_size(vc, attr, uni_mode);
>  		if (size < 0) {
> -			if (read)
> -				break;
>  			ret = size;
> -			goto unlock_out;
> +			break;
>  		}
>  		if (pos >= size)
>  			break;
> -- 
> 2.31.1
>