>From ad143ede24ff4e61292cc9c96000100aacd97259 Mon Sep 17 00:00:00 2001
From: Yunhai Zhang <zhangyunhai () nsfocus com>
Date: Tue, 28 Jul 2020 09:58:03 +0800
Subject: [PATCH] Fix for missing check in vgacon scrollback handling

vgacon_scrollback_update() always left enbough room in the scrollback
buffer for the next call, but if the console size changed that room
might not actually be enough, and so we need to re-check.

This fixes CVE-2020-14331.

Reported-and-debugged-by: 张云海 <zhangyunhai () nsfocus com>
Reported-and-debugged-by: Yang Yingliang <yangyingliang () huawei com>
Reported-by: Kyungtae Kim <kt0755 () gmail com>
Fixes: 15bdab959c9b ([PATCH] vgacon: Add support for soft scrollback)
Cc: Linus Torvalds <torvalds () linux-foundation org>
Cc: Greg KH <greg () kroah com>
Cc: Solar Designer <solar () openwall com>
Cc: "Srivatsa S. Bhat" <srivatsa () csail mit edu>
Cc: Anthony Liguori <aliguori () amazon com>
Cc: Yang Yingliang <yangyingliang () huawei com>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie () samsung com>
Signed-off-by: Yunhai Zhang <zhangyunhai () nsfocus com>
---
 drivers/video/console/vgacon.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 998b0de1812f..37b5711cd958 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -251,6 +251,10 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
 	p = (void *) (c->vc_origin + t * c->vc_size_row);
 
 	while (count--) {
+		if ((vgacon_scrollback_cur->tail + c->vc_size_row) > 
+		    vgacon_scrollback_cur->size)
+			vgacon_scrollback_cur->tail = 0;
+
 		scr_memcpyw(vgacon_scrollback_cur->data +
 			    vgacon_scrollback_cur->tail,
 			    p, c->vc_size_row);
-- 
2.25.1