git: 975d7730828a - main - kern: fix panic with disabled ttys

[Ed Maste]

The branch main has been updated by emaste:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=975d7730828a8bde28c2a0092b6e95c4c4e22f34

commit 975d7730828a8bde28c2a0092b6e95c4c4e22f34
Author:     Ed Maste <ema...@freebsd.org>
AuthorDate: 2024-02-26 15:38:45 +0000
Commit:     Ed Maste <ema...@freebsd.org>
CommitDate: 2024-02-26 20:11:27 +0000

    kern: fix panic with disabled ttys
    
    PR: 277240, 277329
    Reviewed by: kib (earlier version)
    Fixes: f1d0a0cbecf2 ("jail: Fix information leak.")
    MFC after: 3 days
    Sponsored by: The FreeBSD Foundation
    Differential Revision: https://reviews.freebsd.org/D44086
---
 sys/kern/tty.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/sys/kern/tty.c b/sys/kern/tty.c
index ba20f5727829..b6e300321e9c 100644
--- a/sys/kern/tty.c
+++ b/sys/kern/tty.c
@@ -1315,7 +1315,8 @@ sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
        struct xtty *xtlist, *xt;
        struct tty *tp;
        struct proc *p;
-       int cansee, error;
+       int error;
+       bool cansee;
 
        sx_slock(&tty_list_sx);
        lsize = tty_list_count * sizeof(struct xtty);
@@ -1328,8 +1329,8 @@ sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
 
        TAILQ_FOREACH(tp, &tty_list, t_list) {
                tty_lock(tp);
-               if (tp->t_session != NULL) {
-                       p = tp->t_session->s_leader;
+               if (tp->t_session != NULL &&
+                   (p = atomic_load_ptr(&tp->t_session->s_leader)) != NULL) {
                        PROC_LOCK(p);
                        cansee = (p_cansee(td, p) == 0);
                        PROC_UNLOCK(p);