diff options
| author | Jann Horn <jannh@google.com> | 2020-12-03 02:25:04 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-12-11 13:23:28 +0100 |
| commit | c536ecd4856084604701b95bd7e3fb15f05634bf (patch) | |
| tree | 9a364cad6b9e8e900043efc7439fde012610eeba /drivers/tty/tty_jobctrl.c | |
| parent | 013d2d046532bbe03eb73678e23af538d503440e (diff) | |
| download | linux-stable-c536ecd4856084604701b95bd7e3fb15f05634bf.tar.gz linux-stable-c536ecd4856084604701b95bd7e3fb15f05634bf.tar.bz2 linux-stable-c536ecd4856084604701b95bd7e3fb15f05634bf.zip | |
tty: Fix ->pgrp locking in tiocspgrp()
commit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc upstream.
tiocspgrp() takes two tty_struct pointers: One to the tty that userspace
passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`).
These pointers are different when ioctl() is called with a master fd.
To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock.
This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on
both sides of a PTY pair to corrupt the refcount of `struct pid`,
leading to use-after-free errors.
Fixes: 47f86834bbd4 ("redo locking of tty->pgrp")
CC: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/tty/tty_jobctrl.c')
| -rw-r--r-- | drivers/tty/tty_jobctrl.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/tty/tty_jobctrl.c b/drivers/tty/tty_jobctrl.c index f8ed50a16848..af508957ff05 100644 --- a/drivers/tty/tty_jobctrl.c +++ b/drivers/tty/tty_jobctrl.c @@ -494,10 +494,10 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t if (session_of_pgrp(pgrp) != task_session(current)) goto out_unlock; retval = 0; - spin_lock_irq(&tty->ctrl_lock); + spin_lock_irq(&real_tty->ctrl_lock); put_pid(real_tty->pgrp); real_tty->pgrp = get_pid(pgrp); - spin_unlock_irq(&tty->ctrl_lock); + spin_unlock_irq(&real_tty->ctrl_lock); out_unlock: rcu_read_unlock(); return retval; |