summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPeter Hurley <peter@hurleysoftware.com>2014-10-16 14:59:44 -0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2014-11-05 16:26:13 -0800
commit8a8a55105dd2857743dc4f7097f28a6cb2e696ee (patch)
treecb6a39846c57a68202e23d3f350b192f355e60d3
parentbce65f18316cc6dbf858b1577a36956d30caa315 (diff)
uml: Fix unsafe pid reference to foreground process group
Although the tty core maintains a pid reference for the foreground process group, if the foreground process group is changed that pid reference is dropped. Thus, the pid reference used for signalling could become stale. Safely obtain a pid reference to the foreground process group and release the reference after signalling is complete. cc: Jeff Dike <jdike@addtoit.com> Acked-by: Richard Weinberger <richard@nod.at> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Reviewed-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--arch/um/drivers/line.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index 8035145f043b..62087028a9ce 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -632,6 +632,7 @@ static irqreturn_t winch_interrupt(int irq, void *data)
int fd = winch->fd;
int err;
char c;
+ struct pid *pgrp;
if (fd != -1) {
err = generic_read(fd, &c, NULL);
@@ -657,7 +658,10 @@ static irqreturn_t winch_interrupt(int irq, void *data)
if (line != NULL) {
chan_window_size(line, &tty->winsize.ws_row,
&tty->winsize.ws_col);
- kill_pgrp(tty->pgrp, SIGWINCH, 1);
+ pgrp = tty_get_pgrp(tty);
+ if (pgrp)
+ kill_pgrp(pgrp, SIGWINCH, 1);
+ put_pid(pgrp);
}
tty_kref_put(tty);
}