From d1765b22b52a2eae3f17582b482521f4ddb2577b Mon Sep 17 00:00:00 2001 From: Matheus Date: Mon, 5 Oct 2026 14:28:54 -0300 Subject: [PATCH] tty: fix lifetime issue in tty_unregister() The tty_unregister code removes the tty's vnode from the devfs mappings. This causes a reference to be dropped, which can then cause the tty to be freed and the remaining code in tty_unregister does a UAF. Fix this by holding a reference across the unregister operation. --- kernel-src/io/tty.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel-src/io/tty.c b/kernel-src/io/tty.c index b316bd7d..c21e2ca3 100644 --- a/kernel-src/io/tty.c +++ b/kernel-src/io/tty.c @@ -581,6 +581,8 @@ tty_t *tty_create(char *name, ttydevicewritefn_t writefn, ttyinactivefn_t inacti } void tty_unregister(tty_t *tty) { + vnode_t *mastervnode = tty->mastervnode; + VOP_HOLD(mastervnode); devfs_remove(tty->name, DEV_MAJOR_TTY, tty->minor); proc_t *foreground = getforeground(tty); @@ -588,6 +590,7 @@ void tty_unregister(tty_t *tty) { jobctl_signal(foreground, SIGHUP, NULL); PROC_RELEASE(foreground); } + VOP_RELEASE(mastervnode); } void tty_release(tty_t *tty) {