Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dadb44ac authored by Jann Horn's avatar Jann Horn Committed by urevanth
Browse files

tty: Fix ->pgrp locking in tiocspgrp() 



tiocspgrp() takes two tty_struct pointers: One to the tty that userspace
passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`).
These pointers are different when ioctl() is called with a master fd.

To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock.

This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on
both sides of a PTY pair to corrupt the refcount of `struct pid`,
leading to use-after-free errors.

Fixes: 47f86834 ("redo locking of tty->pgrp")
CC: stable@kernel.org
Signed-off-by: default avatarJann Horn <jannh@google.com>
Reviewed-by: default avatarJiri Slaby <jirislaby@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I0dee7d6745ff1e740de5f8008da63bc9a3c55d0d
Git-commit: 54ffccbf053b5b6ca4f6e45094b942fab92a25fc
Git-repo: https://android.googlesource.com/kernel/msm


Signed-off-by: default avatarurevanth <urevanth@codeaurora.org>
parent f0133407

drivers/tty/tty_jobctrl.c

+2 −2
Original line number Diff line number Diff line
@@ -494,10 +494,10 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t 
	if (session_of_pgrp(pgrp) != task_session(current))

		goto out_unlock;

	retval = 0;

	spin_lock_irq(&tty->ctrl_lock);

	spin_lock_irq(&real_tty->ctrl_lock);

	put_pid(real_tty->pgrp);

	real_tty->pgrp = get_pid(pgrp);

	spin_unlock_irq(&tty->ctrl_lock);

	spin_unlock_irq(&real_tty->ctrl_lock);

out_unlock:

	rcu_read_unlock();

	return retval;