pty: fix possible use after free of tty->driver_data (2831c89f) · Commits · 戴 / test

This change fixes a bug for a corner case where we have the the last release from a pty master/slave coming from a previously opened /dev/tty file. When this happens, the tty->driver_data can be stale, due to all ptmx or pts/N files having already been closed before (and thus the inode related to these files, which tty->driver_data points to, being already freed/destroyed). The fix here is to keep a reference on the opened master ptmx inode. We maintain the inode referenced until the final pty_unix98_shutdown, and only pass this inode to devpts_kill_index. Signed-off-by:

Herton R. Krzesinski <herton@redhat.com> Cc: <stable@vger.kernel.org> # 2.6.29+ Reviewed-by:

Peter Hurley <peter@hurleysoftware.com> Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/tty/pty.c

+17 −1

Original line number	Diff line number	Diff line
		@@ -681,7 +681,14 @@ static void pty_unix98_remove(struct tty_driver driver, struct tty_struct tty)
		/* this is called once with whichever end is closed last */
		static void pty_unix98_shutdown(struct tty_struct *tty)
		{
		devpts_kill_index(tty->driver_data, tty->index);
		struct inode *ptmx_inode;

		if (tty->driver->subtype == PTY_TYPE_MASTER)
		ptmx_inode = tty->driver_data;
		else
		ptmx_inode = tty->link->driver_data;
		devpts_kill_index(ptmx_inode, tty->index);
		iput(ptmx_inode); /* drop reference we acquired at ptmx_open */
		}

		static const struct tty_operations ptm_unix98_ops = {
		@@ -773,6 +780,15 @@ static int ptmx_open(struct inode inode, struct file filp)
		set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
		tty->driver_data = inode;

		/*
		* In the case where all references to ptmx inode are dropped and we
		* still have /dev/tty opened pointing to the master/slave pair (ptmx
		* is closed/released before /dev/tty), we must make sure that the inode
		* is still valid when we call the final pty_unix98_shutdown, thus we
		* hold an additional reference to the ptmx inode
		*/
		ihold(inode);

		tty_add_file(tty, filp);

		slave_inode = devpts_pty_new(inode,

Admin message