On 06/29/2015 07:59 PM, Patrick Donnelly wrote:
> task_pgrp requires an rcu or tasklist lock to be obtained if the returned pid
> is to be dereferenced, which kill_pgrp does. Obtain an RCU lock for the
> duration of use.
>
> Signed-off-by: Patrick Donnelly <batr...@batbytes.com>
> ---
> drivers/tty/n_tty.c | 12 ++++++++++--
> drivers/tty/tty_io.c | 17 ++++++++++++-----
> 2 files changed, 22 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
> index c9c27f6..0d631f8 100644
> --- a/drivers/tty/n_tty.c
> +++ b/drivers/tty/n_tty.c
> @@ -2137,6 +2137,8 @@ extern ssize_t redirected_tty_write(struct file *,
> const char __user *,
>
> static int job_control(struct tty_struct *tty, struct file *file)
> {
> + struct pid *pgrp;
> +
> /* Job control check -- must be done at start and after
> every sleep (POSIX.1 7.1.1.4). */
> /* NOTE: not yet done after every sleep pending a thorough
> @@ -2146,18 +2148,24 @@ static int job_control(struct tty_struct *tty, struct
> file *file)
> current->signal->tty != tty)
> return 0;
>
> + rcu_read_lock();
> + pgrp = task_pgrp(current);
> +
> spin_lock_irq(&tty->ctrl_lock);
> +
> if (!tty->pgrp)
> printk(KERN_ERR "n_tty_read: no tty->pgrp!\n");
> - else if (task_pgrp(current) != tty->pgrp) {
> + else if (pgrp != tty->pgrp) {
> spin_unlock_irq(&tty->ctrl_lock);
> if (is_ignored(SIGTTIN) || is_current_pgrp_orphaned())
> return -EIO;
I just realized there's a missing rcu_read_unlock() from this early return.
Regards,
Peter Hurley
> - kill_pgrp(task_pgrp(current), SIGTTIN, 1);
> + kill_pgrp(pgrp, SIGTTIN, 1);
> + rcu_read_unlock();
> set_thread_flag(TIF_SIGPENDING);
> return -ERESTARTSYS;
> }
> spin_unlock_irq(&tty->ctrl_lock);
> + rcu_read_unlock();
> return 0;
> }
>
> diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
> index 57fc6ee..6bdfb98 100644
> --- a/drivers/tty/tty_io.c
> +++ b/drivers/tty/tty_io.c
> @@ -388,33 +388,40 @@ EXPORT_SYMBOL_GPL(tty_find_polling_driver);
> int tty_check_change(struct tty_struct *tty)
> {
> unsigned long flags;
> + struct pid *pgrp;
> int ret = 0;
>
> if (current->signal->tty != tty)
> return 0;
>
> + rcu_read_lock();
> + pgrp = task_pgrp(current);
> +
> spin_lock_irqsave(&tty->ctrl_lock, flags);
>
> if (!tty->pgrp) {
> printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n");
> goto out_unlock;
> }
> - if (task_pgrp(current) == tty->pgrp)
> + if (pgrp == tty->pgrp)
> goto out_unlock;
> spin_unlock_irqrestore(&tty->ctrl_lock, flags);
> +
> if (is_ignored(SIGTTOU))
> - goto out;
> + goto out_rcuunlock;
> if (is_current_pgrp_orphaned()) {
> ret = -EIO;
> - goto out;
> + goto out_rcuunlock;
> }
> - kill_pgrp(task_pgrp(current), SIGTTOU, 1);
> + kill_pgrp(pgrp, SIGTTOU, 1);
> + rcu_read_unlock();
> set_thread_flag(TIF_SIGPENDING);
> ret = -ERESTARTSYS;
> -out:
> return ret;
> out_unlock:
> spin_unlock_irqrestore(&tty->ctrl_lock, flags);
> +out_rcuunlock:
> + rcu_read_unlock();
> return ret;
> }
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
