diff options
| author | Jann Horn <[email protected]> | 2020-12-03 01:25:04 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2020-12-04 16:38:48 +0000 |
| commit | 54ffccbf053b5b6ca4f6e45094b942fab92a25fc (patch) | |
| tree | b30e76730582ec6960a35741dea3023040afbaf0 /tools/perf/python/tracepoint.py | |
| parent | Linux 5.10-rc5 (diff) | |
| download | kernel-54ffccbf053b5b6ca4f6e45094b942fab92a25fc.tar.gz kernel-54ffccbf053b5b6ca4f6e45094b942fab92a25fc.zip | |
tty: Fix ->pgrp locking in tiocspgrp()
tiocspgrp() takes two tty_struct pointers: One to the tty that userspace
passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`).
These pointers are different when ioctl() is called with a master fd.
To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock.
This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on
both sides of a PTY pair to corrupt the refcount of `struct pid`,
leading to use-after-free errors.
Fixes: 47f86834bbd4 ("redo locking of tty->pgrp")
CC: [email protected]
Signed-off-by: Jann Horn <[email protected]>
Reviewed-by: Jiri Slaby <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'tools/perf/python/tracepoint.py')
0 files changed, 0 insertions, 0 deletions