# git rev-parse -q --verify ae3419fbac845b4d3f3a9fae4cc80c68d82cdf6e^{commit} ae3419fbac845b4d3f3a9fae4cc80c68d82cdf6e already have revision, skipping fetch # git checkout -q -f -B kisskb ae3419fbac845b4d3f3a9fae4cc80c68d82cdf6e # git clean -qxdf # < git log -1 # commit ae3419fbac845b4d3f3a9fae4cc80c68d82cdf6e # Author: Thomas Weißschuh # Date: Mon Feb 20 06:46:12 2023 +0000 # # vc_screen: don't clobber return value in vcs_read # # Commit 226fae124b2d ("vc_screen: move load of struct vc_data pointer in # vcs_read() to avoid UAF") moved the call to vcs_vc() into the loop. # # While doing this it also moved the unconditional assignment of # # ret = -ENXIO; # # This unconditional assignment was valid outside the loop but within it # it clobbers the actual value of ret. # # To avoid this only assign "ret = -ENXIO" when actually needed. # # [ Also, the 'goto unlock_out" needs to be just a "break", so that it # does the right thing when it exits on later iterations when partial # success has happened - Linus ] # # Reported-by: Storm Dragon # Link: https://lore.kernel.org/lkml/Y%2FKS6vdql2pIsCiI@hotmail.com/ # Fixes: 226fae124b2d ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF") # Signed-off-by: Thomas Weißschuh # Link: https://lore.kernel.org/lkml/64981d94-d00c-4b31-9063-43ad0a384bde@t-8ch.de/ # Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/korg/gcc-8.5.0-nolibc/m68k-linux/bin/m68k-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-8.5.0-nolibc/m68k-linux/bin/m68k-linux-ld --version # < git log --format=%s --max-count=1 ae3419fbac845b4d3f3a9fae4cc80c68d82cdf6e # < make -s -j 32 ARCH=m68k O=/kisskb/build/linus_sun3_defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.5.0-nolibc/m68k-linux/bin/m68k-linux- sun3_defconfig # < make -s -j 32 ARCH=m68k O=/kisskb/build/linus_sun3_defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.5.0-nolibc/m68k-linux/bin/m68k-linux- help # make -s -j 32 ARCH=m68k O=/kisskb/build/linus_sun3_defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.5.0-nolibc/m68k-linux/bin/m68k-linux- olddefconfig # make -s -j 32 ARCH=m68k O=/kisskb/build/linus_sun3_defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.5.0-nolibc/m68k-linux/bin/m68k-linux- In file included from /kisskb/src/include/linux/swab.h:5, from /kisskb/src/include/uapi/linux/byteorder/big_endian.h:14, from /kisskb/src/include/linux/byteorder/big_endian.h:5, from /kisskb/src/arch/m68k/include/uapi/asm/byteorder.h:5, from /kisskb/src/include/asm-generic/bitops/le.h:6, from /kisskb/src/arch/m68k/include/asm/bitops.h:545, from /kisskb/src/include/linux/bitops.h:68, from /kisskb/src/include/linux/kernel.h:22, from /kisskb/src/drivers/net/ethernet/i825xx/sun3_82586.c:31: /kisskb/src/drivers/net/ethernet/i825xx/sun3_82586.c: In function 'sun3_82586_timeout': /kisskb/src/drivers/net/ethernet/i825xx/sun3_82586.c:989:108: warning: array subscript 1 is above array bounds of 'volatile struct transmit_cmd_struct *[1]' [-Warray-bounds] printk("%s: command-stats: %04x %04x\n",dev->name,swab16(p->xmit_cmds[0]->cmd_status),swab16(p->xmit_cmds[1]->cmd_status)); ~~~~~~~~~~~~^~~ /kisskb/src/include/uapi/linux/swab.h:107:12: note: in definition of macro '__swab16' __fswab16(x)) ^ /kisskb/src/include/linux/printk.h:455:26: note: in expansion of macro 'printk_index_wrap' #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) ^~~~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/i825xx/sun3_82586.c:989:3: note: in expansion of macro 'printk' printk("%s: command-stats: %04x %04x\n",dev->name,swab16(p->xmit_cmds[0]->cmd_status),swab16(p->xmit_cmds[1]->cmd_status)); ^~~~~~ In file included from /kisskb/src/include/linux/rculist.h:10, from /kisskb/src/include/linux/pid.h:5, from /kisskb/src/include/linux/sched.h:14, from /kisskb/src/fs/btrfs/volumes.c:6: /kisskb/src/fs/btrfs/volumes.c: In function 'btrfs_init_new_device': /kisskb/src/include/linux/list.h:74:12: warning: 'seed_devices' may be used uninitialized in this function [-Wmaybe-uninitialized] new->prev = prev; ~~~~~~~~~~^~~~~~ /kisskb/src/fs/btrfs/volumes.c:2612:27: note: 'seed_devices' was declared here struct btrfs_fs_devices *seed_devices; ^~~~~~~~~~~~ Completed OK # rm -rf /kisskb/build/linus_sun3_defconfig_m68k-gcc8 # Build took: 0:01:30.868874