From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932830AbXCRSqY (ORCPT ); Sun, 18 Mar 2007 14:46:24 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S932837AbXCRSqX (ORCPT ); Sun, 18 Mar 2007 14:46:23 -0400 Received: from ebiederm.dsl.xmission.com ([166.70.28.69]:49329 "EHLO ebiederm.dsl.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932830AbXCRSqX (ORCPT ); Sun, 18 Mar 2007 14:46:23 -0400 From: ebiederm@xmission.com (Eric W. Biederman) To: Linus Torvalds Cc: Andrew Morton , "Linux Kernel Mailing List" , "Catalin Marinas" Subject: [PATCH] tty: Fix two reported pid leaks References: Date: Sun, 18 Mar 2007 12:45:44 -0600 In-Reply-To: (Catalin Marinas's message of "Fri, 16 Mar 2007 22:44:14 +0000") Message-ID: User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/21.4 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org These leaks were reported by: Catalin Marinas and I have been able to very by inspection they are possible. When converting tty_io.c to store pids as struct pid pointers instead of pid_t values it appears I overlooked two places where we stop using the pid value. The very obvious one is in do_tty_hangup, and the one the less obvious one in __proc_set_tty. When looking into the code __proc_set_tty only has pids that need to be put because of failures of other parts of the code to properly perform hangup processing. Fixing the leak here in __proc_set_tty is easy and obviously correct so I am doing that first. Fixing the places that should be performing hangup processing is much less obviously correct. So those I'm aiming those patches at -mm. for now, so the can age a while before they are merged. Signed-off-by: Eric W. Biederman --- drivers/char/tty_io.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c index e453268..7a32df5 100644 --- a/drivers/char/tty_io.c +++ b/drivers/char/tty_io.c @@ -1376,6 +1376,8 @@ static void do_tty_hangup(struct work_struct *work) read_unlock(&tasklist_lock); tty->flags = 0; + put_pid(tty->session); + put_pid(tty->pgrp); tty->session = NULL; tty->pgrp = NULL; tty->ctrl_status = 0; @@ -3841,6 +3843,9 @@ static struct pid *__proc_set_tty(struct task_struct *tsk, struct tty_struct *tt { struct pid *old_pgrp; if (tty) { + /* We should not have a session or pgrp to here but.... */ + put_pid(tty->session); + put_pid(tty->pgrp); tty->session = get_pid(task_session(tsk)); tty->pgrp = get_pid(task_pgrp(tsk)); } -- 1.5.0.g53756