Commit 2c411c11 authored by Peter Hurley's avatar Peter Hurley Committed by Greg Kroah-Hartman
Browse files

tty: Fix multiple races when setting the controlling terminal 



Claim a read lock on the tasklist_lock while setting the controlling
terminal for the session leader. This fixes multiple races:
1. task_pgrp() and task_session() cannot be safely dereferenced, such
   as passing to get_pid(), without holding either rcu_read_lock() or
   tasklist_lock
2. setsid() unwisely allows any thread in the thread group to
   make the thread group leader the session leader; this makes the
   unlocked reads of ->signal->leader and signal->tty potentially
   unordered, stale or even have spurious values.

Signed-off-by: default avatarPeter Hurley <peter@hurleysoftware.com>
Reviewed-by: default avatarAlan Cox <alan@linux.intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ae28fa72

drivers/tty/tty_io.c

+17 −6
Original line number Diff line number Diff line
@@ -502,8 +502,15 @@ void proc_clear_tty(struct task_struct *p) 
	tty_kref_put(tty);

}



/* Called under the sighand lock */



/**

 * proc_set_tty -  set the controlling terminal

 *

 * Only callable by the session leader and only if it does not already have

 * a controlling terminal.

 *

 * Caller must hold:  a readlock on tasklist_lock

 *		      sighand lock

 */

static void __proc_set_tty(struct tty_struct *tty)

{

	unsigned long flags;
@@ -2150,6 +2157,7 @@ retry_open: 


	mutex_lock(&tty_mutex);

	tty_lock(tty);

	read_lock(&tasklist_lock);

	spin_lock_irq(&current->sighand->siglock);

	if (!noctty &&

	    current->signal->leader &&
@@ -2157,6 +2165,7 @@ retry_open: 
	    tty->session == NULL)

		__proc_set_tty(tty);

	spin_unlock_irq(&current->sighand->siglock);

	read_unlock(&tasklist_lock);

	tty_unlock(tty);

	mutex_unlock(&tty_mutex);

	return 0;
@@ -2447,10 +2456,13 @@ static int fionbio(struct file *file, int __user *p) 
static int tiocsctty(struct tty_struct *tty, int arg)

{

	int ret = 0;

	if (current->signal->leader && (task_session(current) == tty->session))

		return ret;



	mutex_lock(&tty_mutex);

	read_lock(&tasklist_lock);



	if (current->signal->leader && (task_session(current) == tty->session))

		goto unlock;



	/*

	 * The process must be a session leader and

	 * not have a controlling tty already.
@@ -2469,9 +2481,7 @@ static int tiocsctty(struct tty_struct *tty, int arg) 
			/*

			 * Steal it away

			 */

			read_lock(&tasklist_lock);

			session_clear_tty(tty->session);

			read_unlock(&tasklist_lock);

		} else {

			ret = -EPERM;

			goto unlock;
@@ -2479,6 +2489,7 @@ static int tiocsctty(struct tty_struct *tty, int arg) 
	}

	proc_set_tty(tty);

unlock:

	read_unlock(&tasklist_lock);

	mutex_unlock(&tty_mutex);

	return ret;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE