| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 14 Oct 2006 07:22:18 -0400
From: Prarit Bhargava <prarit@...hat.com>
To: linux-kernel@...r.kernel.org, akpm@...l.org
Cc: Prarit Bhargava <prarit@...hat.com>
Subject: [PATCH]: disassociate tty locking fixups
Additional tty_mutex locking in do_tty_hangup and disassociate_ctty. It is
possible that do_tty_hangup sets current->signal->tty = NULL. If that
happens then disassociate_ctty can corrupt memory.
Signed-off-by: Prarit Bhargava <prarit@...hat.com>
--- linux-2.6.18.x86_64.orig/drivers/char/tty_io.c 2006-10-12 10:05:52.000000000 -0400
+++ linux-2.6.18.x86_64/drivers/char/tty_io.c 2006-10-13 11:19:30.000000000 -0400
@@ -1357,6 +1357,8 @@ static void do_tty_hangup(void *data)
This should get done automatically when the port closes and
tty_release is called */
+ /* it is possible current->signal->tty is modified */
+ mutex_lock(&tty_mutex);
read_lock(&tasklist_lock);
if (tty->session > 0) {
do_each_task_pid(tty->session, PIDTYPE_SID, p) {
@@ -1364,14 +1366,16 @@ static void do_tty_hangup(void *data)
p->signal->tty = NULL;
if (!p->signal->leader)
continue;
+ mutex_unlock(&tty_mutex);
group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
+ mutex_lock(&tty_mutex);
if (tty->pgrp > 0)
p->signal->tty_old_pgrp = tty->pgrp;
} while_each_task_pid(tty->session, PIDTYPE_SID, p);
}
read_unlock(&tasklist_lock);
-
+ mutex_unlock(&tty_mutex);
tty->flags = 0;
tty->session = 0;
tty->pgrp = -1;
@@ -1502,7 +1506,7 @@ void disassociate_ctty(int on_exit)
kill_pg(current->signal->tty_old_pgrp, SIGCONT, on_exit);
}
mutex_unlock(&tty_mutex);
- unlock_kernel();
+ unlock_kernel();
return;
}
if (tty_pgrp > 0) {
@@ -1514,8 +1518,12 @@ void disassociate_ctty(int on_exit)
/* Must lock changes to tty_old_pgrp */
mutex_lock(&tty_mutex);
current->signal->tty_old_pgrp = 0;
- tty->session = 0;
- tty->pgrp = -1;
+
+ /* It is possible that do_tty_hangup has free'd this tty */
+ if (current->signal->tty) {
+ tty->session = 0;
+ tty->pgrp = -1;
+ }
/* Now clear signal->tty under the lock */
read_lock(&tasklist_lock);
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists