From 6719693ca2efb0f04654d05768ee299e87e1694b Mon Sep 17 00:00:00 2001 From: Patrick Donnelly Date: Sun, 12 Jul 2015 18:51:52 -0400 Subject: tty: add missing rcu_read_lock for task_pgrp task_pgrp requires an rcu or tasklist lock to be obtained if the returned pid is to be dereferenced, which kill_pgrp does. Obtain an RCU lock for the duration of use. Signed-off-by: Patrick Donnelly Reviewed-by: Peter Hurley Signed-off-by: Greg Kroah-Hartman --- drivers/tty/n_tty.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'drivers/tty/n_tty.c') diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c index c9c27f69e101..de67b2c88bfc 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c @@ -2137,6 +2137,8 @@ extern ssize_t redirected_tty_write(struct file *, const char __user *, static int job_control(struct tty_struct *tty, struct file *file) { + struct pid *pgrp; + /* Job control check -- must be done at start and after every sleep (POSIX.1 7.1.1.4). */ /* NOTE: not yet done after every sleep pending a thorough @@ -2146,18 +2148,25 @@ static int job_control(struct tty_struct *tty, struct file *file) current->signal->tty != tty) return 0; + rcu_read_lock(); + pgrp = task_pgrp(current); + spin_lock_irq(&tty->ctrl_lock); if (!tty->pgrp) printk(KERN_ERR "n_tty_read: no tty->pgrp!\n"); - else if (task_pgrp(current) != tty->pgrp) { + else if (pgrp != tty->pgrp) { spin_unlock_irq(&tty->ctrl_lock); - if (is_ignored(SIGTTIN) || is_current_pgrp_orphaned()) + if (is_ignored(SIGTTIN) || is_current_pgrp_orphaned()) { + rcu_read_unlock(); return -EIO; - kill_pgrp(task_pgrp(current), SIGTTIN, 1); + } + kill_pgrp(pgrp, SIGTTIN, 1); + rcu_read_unlock(); set_thread_flag(TIF_SIGPENDING); return -ERESTARTSYS; } spin_unlock_irq(&tty->ctrl_lock); + rcu_read_unlock(); return 0; } -- cgit v1.2.1