diff options
| author | Peter Hurley <peter@hurleysoftware.com> | 2014-10-16 20:59:47 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-11-06 01:26:13 +0100 |
| commit | 2c411c11020ff356748268ca9cae4c1b4c410f00 (patch) | |
| tree | 77364bc6b8920b9a644416d2e5327f63ad232382 | |
| parent | tty: Remove !tty condition from __proc_set_tty() (diff) | |
| download | linux-2c411c11020ff356748268ca9cae4c1b4c410f00.tar.xz linux-2c411c11020ff356748268ca9cae4c1b4c410f00.zip | |
tty: Fix multiple races when setting the controlling terminal
Claim a read lock on the tasklist_lock while setting the controlling
terminal for the session leader. This fixes multiple races:
1. task_pgrp() and task_session() cannot be safely dereferenced, such
as passing to get_pid(), without holding either rcu_read_lock() or
tasklist_lock
2. setsid() unwisely allows any thread in the thread group to
make the thread group leader the session leader; this makes the
unlocked reads of ->signal->leader and signal->tty potentially
unordered, stale or even have spurious values.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Reviewed-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/tty/tty_io.c | 23 |
1 files changed, 17 insertions, 6 deletions
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index b645519300c2..114854c5554b 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -502,8 +502,15 @@ void proc_clear_tty(struct task_struct *p) tty_kref_put(tty); } -/* Called under the sighand lock */ - +/** + * proc_set_tty - set the controlling terminal + * + * Only callable by the session leader and only if it does not already have + * a controlling terminal. + * + * Caller must hold: a readlock on tasklist_lock + * sighand lock + */ static void __proc_set_tty(struct tty_struct *tty) { unsigned long flags; @@ -2150,6 +2157,7 @@ retry_open: mutex_lock(&tty_mutex); tty_lock(tty); + read_lock(&tasklist_lock); spin_lock_irq(¤t->sighand->siglock); if (!noctty && current->signal->leader && @@ -2157,6 +2165,7 @@ retry_open: tty->session == NULL) __proc_set_tty(tty); spin_unlock_irq(¤t->sighand->siglock); + read_unlock(&tasklist_lock); tty_unlock(tty); mutex_unlock(&tty_mutex); return 0; @@ -2447,10 +2456,13 @@ static int fionbio(struct file *file, int __user *p) static int tiocsctty(struct tty_struct *tty, int arg) { int ret = 0; - if (current->signal->leader && (task_session(current) == tty->session)) - return ret; mutex_lock(&tty_mutex); + read_lock(&tasklist_lock); + + if (current->signal->leader && (task_session(current) == tty->session)) + goto unlock; + /* * The process must be a session leader and * not have a controlling tty already. @@ -2469,9 +2481,7 @@ static int tiocsctty(struct tty_struct *tty, int arg) /* * Steal it away */ - read_lock(&tasklist_lock); session_clear_tty(tty->session); - read_unlock(&tasklist_lock); } else { ret = -EPERM; goto unlock; @@ -2479,6 +2489,7 @@ static int tiocsctty(struct tty_struct *tty, int arg) } proc_set_tty(tty); unlock: + read_unlock(&tasklist_lock); mutex_unlock(&tty_mutex); return ret; } |