Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0e187622 authored by Jann Horn's avatar Jann Horn Committed by laxman
Browse files

[CVE-2020-29661] tty: Fix ->pgrp locking in tiocspgrp() 

Change-Id: Ifcbeacdce6e6c7e1b167be6d763affa476999180
parent 2049d766

drivers/tty/tty_jobctrl.c

+2 −2
Original line number Diff line number Diff line
@@ -494,10 +494,10 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t 
	if (session_of_pgrp(pgrp) != task_session(current))

		goto out_unlock;

	retval = 0;

	spin_lock_irq(&tty->ctrl_lock);

	spin_lock_irq(&real_tty->ctrl_lock);

	put_pid(real_tty->pgrp);

	real_tty->pgrp = get_pid(pgrp);

	spin_unlock_irq(&tty->ctrl_lock);

	spin_unlock_irq(&real_tty->ctrl_lock);

out_unlock:

	rcu_read_unlock();

	return retval;