Commit 8a8a5510 authored Oct 16, 2014 by Peter Hurley Committed by Greg Kroah-Hartman Nov 05, 2014

uml: Fix unsafe pid reference to foreground process group



Although the tty core maintains a pid reference for the foreground
process group, if the foreground process group is changed that
pid reference is dropped. Thus, the pid reference used for signalling
could become stale.

Safely obtain a pid reference to the foreground process group and
release the reference after signalling is complete.

cc: Jeff Dike <jdike@addtoit.com>
Acked-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Reviewed-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent bce65f18

arch/um/drivers/line.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -632,6 +632,7 @@ static irqreturn_t winch_interrupt(int irq, void *data)
		int fd = winch->fd;
		int err;
		char c;
		struct pid *pgrp;

		if (fd != -1) {
		err = generic_read(fd, &c, NULL);
		@@ -657,7 +658,10 @@ static irqreturn_t winch_interrupt(int irq, void *data)
		if (line != NULL) {
		chan_window_size(line, &tty->winsize.ws_row,
		&tty->winsize.ws_col);
		kill_pgrp(tty->pgrp, SIGWINCH, 1);
		pgrp = tty_get_pgrp(tty);
		if (pgrp)
		kill_pgrp(pgrp, SIGWINCH, 1);
		put_pid(pgrp);
		}
		tty_kref_put(tty);
		}

Admin message