git: 0a2f49823402 - main - tty: fix a panic with INVARIANTS

[Robert Wing]

The branch main has been updated by rew:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=0a2f498234023008d9a3b13ad7fc8fd81d384bab

commit 0a2f498234023008d9a3b13ad7fc8fd81d384bab
Author:     Robert Wing <r...@freebsd.org>
AuthorDate: 2022-02-22 18:22:18 +0000
Commit:     Robert Wing <r...@freebsd.org>
CommitDate: 2022-02-22 18:37:13 +0000

    tty: fix a panic with INVARIANTS
    
    watch'ing a tty triggers a refcount wraparound panic, take a reference
    on fp after fget_cap_locked() to fix.
    
    Reported by:    Michael Jung <mikej_at_paymentallianceintl.com>
    Reviewed by:    hselasky, mjg
    Fixes:          f40dd6c8034b ("tty: switch ttyhook_register to use 
fget_cap_locked")
    Differential Revision:  https://reviews.freebsd.org/D34335
---
 sys/kern/tty.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/kern/tty.c b/sys/kern/tty.c
index ebb32f698e88..9e6cd8d317cc 100644
--- a/sys/kern/tty.c
+++ b/sys/kern/tty.c
@@ -2083,6 +2083,8 @@ ttyhook_register(struct tty **rtp, struct proc *p, int 
fd, struct ttyhook *th,
        FILEDESC_SLOCK(fdp);
        error = fget_cap_locked(fdp, fd, cap_rights_init_one(&rights, 
CAP_TTYHOOK),
            &fp, NULL);
+       if (error == 0 && !fhold(fp))
+               error = EBADF;
        FILEDESC_SUNLOCK(fdp);
        if (error != 0)
                return (error);