lkml.org 
[lkml]   [2020]   [Dec]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 12/31] tty: Fix ->pgrp locking in tiocspgrp()
    Date
    From: Jann Horn <jannh@google.com>

    commit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc upstream.

    tiocspgrp() takes two tty_struct pointers: One to the tty that userspace
    passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`).
    These pointers are different when ioctl() is called with a master fd.

    To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock.

    This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on
    both sides of a PTY pair to corrupt the refcount of `struct pid`,
    leading to use-after-free errors.

    Fixes: 47f86834bbd4 ("redo locking of tty->pgrp")
    CC: stable@kernel.org
    Signed-off-by: Jann Horn <jannh@google.com>
    Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/tty/tty_jobctrl.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/drivers/tty/tty_jobctrl.c
    +++ b/drivers/tty/tty_jobctrl.c
    @@ -493,10 +493,10 @@ static int tiocspgrp(struct tty_struct *
    if (session_of_pgrp(pgrp) != task_session(current))
    goto out_unlock;
    retval = 0;
    - spin_lock_irq(&tty->ctrl_lock);
    + spin_lock_irq(&real_tty->ctrl_lock);
    put_pid(real_tty->pgrp);
    real_tty->pgrp = get_pid(pgrp);
    - spin_unlock_irq(&tty->ctrl_lock);
    + spin_unlock_irq(&real_tty->ctrl_lock);
    out_unlock:
    rcu_read_unlock();
    return retval;

    \
     
     \ /
      Last update: 2020-12-10 15:34    [W:4.236 / U:0.244 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site