From: Edward Adam Davis Date: Tue, 9 Sep 2025 00:51:22 +0000 (+0800) Subject: vt: move vc_saved_screen to within tty allocated judgment X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fc702e7df456e219f029d0192fbc7cb357a16f4c;p=thirdparty%2Fkernel%2Fstable.git vt: move vc_saved_screen to within tty allocated judgment Everything starts with the assumption that a tty has been allocated. Therefore, Move it to within the tty allocation check. Fixes: 23743ba64709 ("vt: add support for smput/rmput escape codes") Reported-by: syzbot+f6cb41c144427dc0796a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f6cb41c144427dc0796a Tested-by: syzbot+f6cb41c144427dc0796a@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/tencent_CAD45DB31906CF890DBB25AB0DED12205D07@qq.com Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 1d9abcfac4c91..6e0089b85c270 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -1341,10 +1341,10 @@ struct vc_data *vc_deallocate(unsigned int currcons) vc_uniscr_set(vc, NULL); kfree(vc->vc_screenbuf); vc_cons[currcons].d = NULL; - } - if (vc->vc_saved_screen != NULL) { - kfree(vc->vc_saved_screen); - vc->vc_saved_screen = NULL; + if (vc->vc_saved_screen != NULL) { + kfree(vc->vc_saved_screen); + vc->vc_saved_screen = NULL; + } } return vc; }