Defer funsetown() calls for a TTY to tty_rel_free().
We were otherwise failing to call funsetown() for some descriptors associated with a tty, such as pts descriptors. Then, if the descriptor is closed before the owner exits, we may get memory corruption. Reported by: syzbot+c9b6206303bf47bac87e@syzkaller.appspotmail.com Reviewed by: ed MFC after: 3 days Sponsored by: The FreeBSD Foundation
This commit is contained in:
parent
17f1623d42
commit
6a01874c5a
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=349733
@ -238,9 +238,6 @@ ttydev_leave(struct tty *tp)
|
||||
|
||||
tp->t_flags |= TF_OPENCLOSE;
|
||||
|
||||
/* Stop asynchronous I/O. */
|
||||
funsetown(&tp->t_sigio);
|
||||
|
||||
/* Remove console TTY. */
|
||||
if (constty == tp)
|
||||
constty_clear();
|
||||
@ -1134,6 +1131,9 @@ tty_rel_free(struct tty *tp)
|
||||
return;
|
||||
}
|
||||
|
||||
/* Stop asynchronous I/O. */
|
||||
funsetown(&tp->t_sigio);
|
||||
|
||||
/* TTY can be deallocated. */
|
||||
dev = tp->t_dev;
|
||||
tp->t_dev = NULL;
|
||||
|
Loading…
Reference in New Issue
Block a user