Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 24 Jul 2019 12:53:06 +0000 (UTC)
From:      Gordon Tetlow <gordon@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org
Subject:   svn commit: r350282 - in releng: 11.2/sys/kern 11.3/sys/kern 12.0/sys/kern
Message-ID:  <201907241253.x6OCr6EY076207@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: gordon
Date: Wed Jul 24 12:53:06 2019
New Revision: 350282
URL: https://svnweb.freebsd.org/changeset/base/350282

Log:
  Fix pts write-after-free.
  
  Approved by:	so
  Security:	FreeBSD-SA-19:13.pts
  Security:	CVE-2019-5606

Modified:
  releng/11.2/sys/kern/tty.c
  releng/11.3/sys/kern/tty.c
  releng/12.0/sys/kern/tty.c

Modified: releng/11.2/sys/kern/tty.c
==============================================================================
--- releng/11.2/sys/kern/tty.c	Wed Jul 24 12:51:52 2019	(r350281)
+++ releng/11.2/sys/kern/tty.c	Wed Jul 24 12:53:06 2019	(r350282)
@@ -230,9 +230,6 @@ ttydev_leave(struct tty *tp)
 
 	tp->t_flags |= TF_OPENCLOSE;
 
-	/* Stop asynchronous I/O. */
-	funsetown(&tp->t_sigio);
-
 	/* Remove console TTY. */
 	if (constty == tp)
 		constty_clear();
@@ -1122,6 +1119,9 @@ tty_rel_free(struct tty *tp)
 		tty_unlock(tp);
 		return;
 	}
+
+	/* Stop asynchronous I/O. */
+	funsetown(&tp->t_sigio);
 
 	/* TTY can be deallocated. */
 	dev = tp->t_dev;

Modified: releng/11.3/sys/kern/tty.c
==============================================================================
--- releng/11.3/sys/kern/tty.c	Wed Jul 24 12:51:52 2019	(r350281)
+++ releng/11.3/sys/kern/tty.c	Wed Jul 24 12:53:06 2019	(r350282)
@@ -230,9 +230,6 @@ ttydev_leave(struct tty *tp)
 
 	tp->t_flags |= TF_OPENCLOSE;
 
-	/* Stop asynchronous I/O. */
-	funsetown(&tp->t_sigio);
-
 	/* Remove console TTY. */
 	if (constty == tp)
 		constty_clear();
@@ -1122,6 +1119,12 @@ tty_rel_free(struct tty *tp)
 		tty_unlock(tp);
 		return;
 	}
+
+	/* Stop asynchronous I/O. */
+	funsetown(&tp->t_sigio);
+
+	/* Stop asynchronous I/O. */
+	funsetown(&tp->t_sigio);
 
 	/* TTY can be deallocated. */
 	dev = tp->t_dev;

Modified: releng/12.0/sys/kern/tty.c
==============================================================================
--- releng/12.0/sys/kern/tty.c	Wed Jul 24 12:51:52 2019	(r350281)
+++ releng/12.0/sys/kern/tty.c	Wed Jul 24 12:53:06 2019	(r350282)
@@ -231,9 +231,6 @@ ttydev_leave(struct tty *tp)
 
 	tp->t_flags |= TF_OPENCLOSE;
 
-	/* Stop asynchronous I/O. */
-	funsetown(&tp->t_sigio);
-
 	/* Remove console TTY. */
 	if (constty == tp)
 		constty_clear();
@@ -1123,6 +1120,9 @@ tty_rel_free(struct tty *tp)
 		tty_unlock(tp);
 		return;
 	}
+
+	/* Stop asynchronous I/O. */
+	funsetown(&tp->t_sigio);
 
 	/* TTY can be deallocated. */
 	dev = tp->t_dev;



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201907241253.x6OCr6EY076207>