From: Xin Xiong <xiongx18@fudan.edu.cn>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Jiri Slaby <jslaby@suse.com>,
linux-kernel@vger.kernel.org
Cc: Xiyu Yang <xiyuyang19@fudan.edu.cn>,
Xin Tan <tanxin.ctf@gmail.com>,
yuanxzhang@fudan.edu.cn, Xin Xiong <xiongx18@fudan.edu.cn>
Subject: [PATCH] tty: fix pid refcount leak in tty_signal_session_leader
Date: Sun, 26 Jul 2020 13:28:04 +0800 [thread overview]
Message-ID: <20200726052804.GA51199@xin-virtual-machine> (raw)
In the loop, every time when p->signal->leader is true, the function
tty_signal_session_leader() will invoke get_pid() and return a
reference of tty->pgrp with increased refcount to the local variable
tty_pgrp or return NULL if it fails. After finishing the loop, the
function invokes put_pid() for only once, decreasing the refcount that
tty_pgrp keeps.
Refcount leaks may occur when the scenario that p->signal->leader is
true happens more than once. In this assumption, if the above scenario
happens n times in the loop, the function forgets to decrease the
refcount for n-1 times, which causes refcount leaks.
Fix the issue by decreasing the current refcount of the local variable
tty_pgrp before assigning new objects to it.
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
---
drivers/tty/tty_jobctrl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/tty/tty_jobctrl.c b/drivers/tty/tty_jobctrl.c
index f8ed50a16848..9e6bf693ade1 100644
--- a/drivers/tty/tty_jobctrl.c
+++ b/drivers/tty/tty_jobctrl.c
@@ -212,6 +212,8 @@ int tty_signal_session_leader(struct tty_struct *tty, int exit_session)
__group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
put_pid(p->signal->tty_old_pgrp); /* A noop */
spin_lock(&tty->ctrl_lock);
+ if (tty_pgrp)
+ put_pid(tty_pgrp);
tty_pgrp = get_pid(tty->pgrp);
if (tty->pgrp)
p->signal->tty_old_pgrp = get_pid(tty->pgrp);
--
2.25.1
next reply other threads:[~2020-07-26 5:29 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-26 5:28 Xin Xiong [this message]
2020-07-26 7:06 ` [PATCH] tty: fix pid refcount leak in tty_signal_session_leader Greg Kroah-Hartman
2020-07-26 8:55 ` Andy Shevchenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200726052804.GA51199@xin-virtual-machine \
--to=xiongx18@fudan.edu.cn \
--cc=gregkh@linuxfoundation.org \
--cc=jslaby@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=tanxin.ctf@gmail.com \
--cc=xiyuyang19@fudan.edu.cn \
--cc=yuanxzhang@fudan.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.