Author: hselasky
Date: Fri May 22 09:02:40 2020
New Revision: 361359
URL: https://svnweb.freebsd.org/changeset/base/361359
Log:
MFC r361075:
Assign process group of the TTY under the "proctree_lock".
This fixes a race where concurrent calls to doenterpgrp() and
leavepgrp() while TIOCSCTTY is executing may result in tp->t_pgrp
changing value so that tty_rel_pgrp() misses clearing it to NULL. For
more details refer to the use of pgdelete() in the kernel.
No functional change intended.
Panic backtrace:
__mtx_lock_sleep() # page fault due to using destroyed mutex
tty_signal_pgrp()
tty_ioctl()
ptsdev_ioctl()
kern_ioctl()
sys_ioctl()
amd64_syscall()
Sponsored by: Mellanox Technologies
Modified:
stable/9/sys/kern/tty.c
Directory Properties:
stable/9/sys/ (props changed)
Modified: stable/9/sys/kern/tty.c
==============================================================================
--- stable/9/sys/kern/tty.c Fri May 22 09:01:26 2020 (r361358)
+++ stable/9/sys/kern/tty.c Fri May 22 09:02:40 2020 (r361359)
@@ -1611,7 +1611,6 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *da
tp->t_session = p->p_session;
tp->t_session->s_ttyp = tp;
tp->t_sessioncnt++;
- sx_xunlock(&proctree_lock);
/* Assign foreground process group. */
tp->t_pgrp = p->p_pgrp;
@@ -1619,6 +1618,7 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *da
p->p_flag |= P_CONTROLT;
PROC_UNLOCK(p);
+ sx_xunlock(&proctree_lock);
return (0);
}
case TIOCSPGRP: {
_______________________________________________
svn-src-stable-9@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-9
To unsubscribe, send any mail to "svn-src-stable-9-unsubscr...@freebsd.org"
