From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1030470AbXCLQNH (ORCPT ); Mon, 12 Mar 2007 12:13:07 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1030510AbXCLQNG (ORCPT ); Mon, 12 Mar 2007 12:13:06 -0400 Received: from ebiederm.dsl.xmission.com ([166.70.28.69]:55306 "EHLO ebiederm.dsl.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1030470AbXCLQNF (ORCPT ); Mon, 12 Mar 2007 12:13:05 -0400 From: ebiederm@xmission.com (Eric W. Biederman) To: "Catalin Marinas" Cc: "Linux Kernel Mailing List" Subject: Re: Possible "struct pid" leak from tty_io.c References: Date: Mon, 12 Mar 2007 10:12:42 -0600 In-Reply-To: (Catalin Marinas's message of "Mon, 12 Mar 2007 15:07:39 +0000") Message-ID: User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/21.4 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org "Catalin Marinas" writes: > On 09/03/07, Eric W. Biederman wrote: >> If I can manage to focus on this, it looks like the information I need to >> start fixing this. > > I had a look at the second leak reported it seems to be caused by the > same proc_set_tty() call but, in this case, there is no > disassociate_tty() call for the task (and the patch I posted is not > enough). Maybe something like below (no thourough testing): Thanks. That doesn't look to bad. I'm just about to look into this. If I'm lucky all I will need to do is a close code review of your patch. Hopefully I can do that this afternoon. > diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c > index db91398..ea6ca7d 100644 > --- a/drivers/char/tty_io.c > +++ b/drivers/char/tty_io.c > @@ -3854,7 +3854,14 @@ EXPORT_SYMBOL(tty_devnum); > > void proc_clear_tty(struct task_struct *p) > { > + struct tty_struct *tty; > + > spin_lock_irq(&p->sighand->siglock); > + tty = p->signal->tty; > + if (tty) { > + put_pid(tty->session); > + put_pid(tty->pgrp); > + } > p->signal->tty = NULL; > spin_unlock_irq(&p->sighand->siglock); > } Eric