tty: Fix ->pgrp locking in tiocspgrp()
commit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc upstream.
tiocspgrp() takes two tty_struct pointers: One to the tty that userspace
passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`).
These pointers are different when ioctl() is called with a master fd.
To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock.
This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on
both sides of a PTY pair to corrupt the refcount of `struct pid`,
leading to use-after-free errors.
Fixes: 47f86834bbd4 ("redo locking of tty->pgrp")
Signed-off-by: Jann Horn <firstname.lastname@example.org>
Reviewed-by: Jiri Slaby <email@example.com>
Signed-off-by: Greg Kroah-Hartman <firstname.lastname@example.org>
Reviewed-by: Vaibhav Rustagi <email@example.com>
Tested-by: Cusky Presubmit Bot <firstname.lastname@example.org>
1 file changed