tty: Fix multiple races when setting the controlling terminal
authorPeter Hurley <peter@hurleysoftware.com>
Thu, 16 Oct 2014 18:59:47 +0000 (14:59 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 6 Nov 2014 00:26:13 +0000 (16:26 -0800)
commit2c411c11020ff356748268ca9cae4c1b4c410f00
tree77364bc6b8920b9a644416d2e5327f63ad232382
parentae28fa721683f29105d6894c6c1482bf5a470d3b
tty: Fix multiple races when setting the controlling terminal

Claim a read lock on the tasklist_lock while setting the controlling
terminal for the session leader. This fixes multiple races:
1. task_pgrp() and task_session() cannot be safely dereferenced, such
   as passing to get_pid(), without holding either rcu_read_lock() or
   tasklist_lock
2. setsid() unwisely allows any thread in the thread group to
   make the thread group leader the session leader; this makes the
   unlocked reads of ->signal->leader and signal->tty potentially
   unordered, stale or even have spurious values.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Reviewed-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/tty/tty_io.c