mirrors/Astral
1
0
Fork 0
mirror of https://github.com/Mathewnd/Astral.git synced 2026-10-31 22:48:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

pty: fix UAF

Browse Source
This commit is contained in:
Matheus
2026-06-28 21:51:40 -03:00
parent 6657b19e2c
commit f8752e7fac
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel-src/io/pty.c
+7 -7
View File
@@ -228,10 +228,8 @@ static int write(int minor, iovec_iterator_t *iovec_iterator, size_t size, uintm
return 0; return 0;
} }
static void inactive(int minor) { static void ttyinactive(void *_pty) {
pty_t *pty = ptyget(minor); pty_t *pty = _pty;
if (pty == NULL)
return;
freeptyminor(pty->minor); freeptyminor(pty->minor);
freepty(pty); freepty(pty);
@@ -245,7 +243,6 @@ static devops_t devops = {
.poll = poll, .poll = poll,
.read = read, .read = read,
.ioctl = ioctl, .ioctl = ioctl,
.inactive = inactive
}; };
static int open(int oldminor, vnode_t **vnode, int flags) { static int open(int oldminor, vnode_t **vnode, int flags) {
@@ -284,9 +281,12 @@ static int open(int oldminor, vnode_t **vnode, int flags) {
// create a pairing slave device // create a pairing slave device
snprintf(tmpname, 20, "pts/%d", newminor); snprintf(tmpname, 20, "pts/%d", newminor);
pty->tty = tty_create(tmpname, writetopty, NULL, NULL, hup_check, pty); pty->tty = tty_create(tmpname, writetopty, ttyinactive, NULL, hup_check, pty);
if (pty->tty == NULL) { if (pty->tty == NULL) {
VOP_RELEASE(pty->mastervnode); vnode_t *mastervnode = pty->mastervnode;
freeptyminor(newminor);
freepty(pty);
VOP_RELEASE(mastervnode);
return ENOMEM; return ENOMEM;
} }