• Herton R. Krzesinski's avatar
    pty: make sure super_block is still valid in final /dev/tty close · 38bdf7e3
    Herton R. Krzesinski authored
    [ Upstream commit 1f55c718 ]
    
    Considering current pty code and multiple devpts instances, it's possible
    to umount a devpts file system while a program still has /dev/tty opened
    pointing to a previosuly closed pty pair in that instance. In the case all
    ptmx and pts/N files are closed, umount can be done. If the program closes
    /dev/tty after umount is done, devpts_kill_index will use now an invalid
    super_block, which was already destroyed in the umount operation after
    running ->kill_sb. This is another "use after free" type of issue, but now
    related to the allocated super_block instance.
    
    To avoid the problem (warning at ida_remove and potential crashes) for
    this specific case, I added two functions in devpts which grabs additional
    references to the super_block, which pty code now uses so it makes sure
    the super block structure is still valid until pty shutdown is done.
    I also moved the additional inode references to the same functions, which
    also covered similar case with inode being freed before /dev/tty final
    close/shutdown.
    Signed-off-by: default avatarHerton R. Krzesinski <herton@redhat.com>
    Cc: stable@vger.kernel.org # 2.6.29+
    Reviewed-by: default avatarPeter Hurley <peter@hurleysoftware.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
    38bdf7e3
pty.c 22.9 KB