mirrors/Astral
1
0
Fork 0
mirror of https://github.com/Mathewnd/Astral.git synced 2026-10-27 12:48:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

tty: fix lifetime issue in tty_unregister()

Browse Source 
The tty_unregister code removes the tty's vnode from the devfs mappings.
This causes a reference to be dropped, which can then cause the tty to
be freed and the remaining code in tty_unregister does a UAF.

Fix this by holding a reference across the unregister operation.
This commit is contained in:
Matheus
2026-10-05 14:28:54 -03:00
parent cc069554ae
commit d1765b22b5
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel-src/io/tty.c
+3
View File
@@ -581,6 +581,8 @@ tty_t *tty_create(char *name, ttydevicewritefn_t writefn, ttyinactivefn_t inacti
} }
void tty_unregister(tty_t *tty) { void tty_unregister(tty_t *tty) {
vnode_t *mastervnode = tty->mastervnode;
VOP_HOLD(mastervnode);
devfs_remove(tty->name, DEV_MAJOR_TTY, tty->minor); devfs_remove(tty->name, DEV_MAJOR_TTY, tty->minor);
proc_t *foreground = getforeground(tty); proc_t *foreground = getforeground(tty);
@@ -588,6 +590,7 @@ void tty_unregister(tty_t *tty) {
jobctl_signal(foreground, SIGHUP, NULL); jobctl_signal(foreground, SIGHUP, NULL);
PROC_RELEASE(foreground); PROC_RELEASE(foreground);
} }
VOP_RELEASE(mastervnode);
} }
void tty_release(tty_t *tty) { void tty_release(tty_t *tty) {