Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[PATCH] tty: ->signal->tty locking

Browse source 
Fix the locking of signal->tty.

Use ->sighand->siglock to protect ->signal->tty; this lock is already used
by most other members of ->signal/->sighand.  And unless we are 'current'
or the tasklist_lock is held we need ->siglock to access ->signal anyway.

(NOTE: sys_unshare() is broken wrt ->sighand locking rules)

Note that tty_mutex is held over tty destruction, so while holding
tty_mutex any tty pointer remains valid.  Otherwise the lifetime of ttys
are governed by their open file handles.  This leaves some holes for tty
access from signal->tty (or any other non file related tty access).

It solves the tty SLAB scribbles we were seeing.

(NOTE: the change from group_send_sig_info to __group_send_sig_info needs to
       be examined by someone familiar with the security framework, I think
       it is safe given the SEND_SIG_PRIV from other __group_send_sig_info
       invocations)

[schwidefsky@de.ibm.com: 3270 fix]
[akpm@osdl.org: various post-viro fixes]
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Alan Cox <alan@redhat.com>
Cc: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Roland McGrath <roland@redhat.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jeff Dike <jdike@addtoit.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Jan Kara <jack@ucw.cz>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Peter Zijlstra 2006-12-08 02:36:04 -08:00 committed by Linus Torvalds
parent 562f9c574e
commit 24ec839c43
12 changed files with 186 additions and 132 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
arch/sparc64/solaris/misc.c
View file

@ -423,9 +423,7 @@ asmlinkage int solaris_procids(int cmd, s32 pid, s32 pgid)
Solaris setpgrp and setsid? */ Solaris setpgrp and setsid? */
ret = sys_setpgid(0, 0); ret = sys_setpgid(0, 0);
if (ret) return ret; if (ret) return ret;
mutex_lock(&tty_mutex); proc_clear_tty(current);
current->signal->tty = NULL;
mutex_unlock(&tty_mutex);
return process_group(current); return process_group(current);
} }
case 2: /* getsid */ case 2: /* getsid */

7
arch/um/kernel/exec.c
View file

@ -39,12 +39,13 @@ static long execve1(char *file, char __user * __user *argv,
char __user *__user *env) char __user *__user *env)
{ {
long error; long error;
struct tty_struct *tty;
#ifdef CONFIG_TTY_LOG #ifdef CONFIG_TTY_LOG
mutex_lock(&tty_mutex); mutex_lock(&tty_mutex);
task_lock(current); /* FIXME: is this needed ? */ tty = get_current_tty();
log_exec(argv, current->signal->tty); if (tty)
task_unlock(current); log_exec(argv, tty);
mutex_unlock(&tty_mutex); mutex_unlock(&tty_mutex);
#endif #endif
error = do_execve(file, argv, env, &current->thread.regs); error = do_execve(file, argv, env, &current->thread.regs);

223
drivers/char/tty_io.c
View file

@ -126,7 +126,7 @@ EXPORT_SYMBOL(tty_std_termios);
LIST_HEAD(tty_drivers); /* linked list of tty drivers */ LIST_HEAD(tty_drivers); /* linked list of tty drivers */
/* Semaphore to protect creating and releasing a tty. This is shared with /* Mutex to protect creating and releasing a tty. This is shared with
vt.c for deeply disgusting hack reasons */ vt.c for deeply disgusting hack reasons */
DEFINE_MUTEX(tty_mutex); DEFINE_MUTEX(tty_mutex);
EXPORT_SYMBOL(tty_mutex); EXPORT_SYMBOL(tty_mutex);
@ -259,18 +259,6 @@ static int check_tty_count(struct tty_struct *tty, const char *routine)
* Tty buffer allocation management * Tty buffer allocation management
*/ */
/**
* tty_buffer_free_all - free buffers used by a tty
* @tty: tty to free from
*
* Remove all the buffers pending on a tty whether queued with data
* or in the free ring. Must be called when the tty is no longer in use
*
* Locking: none
*/
/** /**
* tty_buffer_free_all - free buffers used by a tty * tty_buffer_free_all - free buffers used by a tty
* @tty: tty to free from * @tty: tty to free from
@ -614,7 +602,7 @@ EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
* they are not on hot paths so a little discipline won't do * they are not on hot paths so a little discipline won't do
* any harm. * any harm.
* *
* Locking: takes termios_sem * Locking: takes termios_mutex
*/ */
static void tty_set_termios_ldisc(struct tty_struct *tty, int num) static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
@ -915,7 +903,7 @@ static void tty_ldisc_enable(struct tty_struct *tty)
* context. * context.
* *
* Locking: takes tty_ldisc_lock. * Locking: takes tty_ldisc_lock.
* called functions take termios_sem * called functions take termios_mutex
*/ */
static int tty_set_ldisc(struct tty_struct *tty, int ldisc) static int tty_set_ldisc(struct tty_struct *tty, int ldisc)
@ -1270,9 +1258,9 @@ EXPORT_SYMBOL_GPL(tty_ldisc_flush);
* redirect lock for undoing redirection * redirect lock for undoing redirection
* file list lock for manipulating list of ttys * file list lock for manipulating list of ttys
* tty_ldisc_lock from called functions * tty_ldisc_lock from called functions
* termios_sem resetting termios data * termios_mutex resetting termios data
* tasklist_lock to walk task list for hangup event * tasklist_lock to walk task list for hangup event
* * ->siglock to protect ->signal/->sighand
*/ */
static void do_tty_hangup(struct work_struct *work) static void do_tty_hangup(struct work_struct *work)
{ {
@ -1354,14 +1342,18 @@ static void do_tty_hangup(struct work_struct *work)
read_lock(&tasklist_lock); read_lock(&tasklist_lock);
if (tty->session > 0) { if (tty->session > 0) {
do_each_task_pid(tty->session, PIDTYPE_SID, p) { do_each_task_pid(tty->session, PIDTYPE_SID, p) {
spin_lock_irq(&p->sighand->siglock);
if (p->signal->tty == tty) if (p->signal->tty == tty)
p->signal->tty = NULL; p->signal->tty = NULL;
if (!p->signal->leader) if (!p->signal->leader) {
spin_unlock_irq(&p->sighand->siglock);
continue; continue;
group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p); }
group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p); __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
__group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
if (tty->pgrp > 0) if (tty->pgrp > 0)
p->signal->tty_old_pgrp = tty->pgrp; p->signal->tty_old_pgrp = tty->pgrp;
spin_unlock_irq(&p->sighand->siglock);
} while_each_task_pid(tty->session, PIDTYPE_SID, p); } while_each_task_pid(tty->session, PIDTYPE_SID, p);
} }
read_unlock(&tasklist_lock); read_unlock(&tasklist_lock);
@ -1453,6 +1445,14 @@ int tty_hung_up_p(struct file * filp)
EXPORT_SYMBOL(tty_hung_up_p); EXPORT_SYMBOL(tty_hung_up_p);
static void session_clear_tty(pid_t session)
{
struct task_struct *p;
do_each_task_pid(session, PIDTYPE_SID, p) {
proc_clear_tty(p);
} while_each_task_pid(session, PIDTYPE_SID, p);
}
/** /**
* disassociate_ctty - disconnect controlling tty * disassociate_ctty - disconnect controlling tty
* @on_exit: true if exiting so need to "hang up" the session * @on_exit: true if exiting so need to "hang up" the session
@ -1469,31 +1469,35 @@ EXPORT_SYMBOL(tty_hung_up_p);
* The argument on_exit is set to 1 if called when a process is * The argument on_exit is set to 1 if called when a process is
* exiting; it is 0 if called by the ioctl TIOCNOTTY. * exiting; it is 0 if called by the ioctl TIOCNOTTY.
* *
* Locking: tty_mutex is taken to protect current->signal->tty * Locking:
* BKL is taken for hysterical raisins * BKL is taken for hysterical raisins
* Tasklist lock is taken (under tty_mutex) to walk process * tty_mutex is taken to protect tty
* lists for the session. * ->siglock is taken to protect ->signal/->sighand
* tasklist_lock is taken to walk process list for sessions
* ->siglock is taken to protect ->signal/->sighand
*/ */
void disassociate_ctty(int on_exit) void disassociate_ctty(int on_exit)
{ {
struct tty_struct *tty; struct tty_struct *tty;
struct task_struct *p;
int tty_pgrp = -1; int tty_pgrp = -1;
int session;
lock_kernel(); lock_kernel();
mutex_lock(&tty_mutex); mutex_lock(&tty_mutex);
tty = current->signal->tty; tty = get_current_tty();
if (tty) { if (tty) {
tty_pgrp = tty->pgrp; tty_pgrp = tty->pgrp;
mutex_unlock(&tty_mutex); mutex_unlock(&tty_mutex);
/* XXX: here we race, there is nothing protecting tty */
if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY) if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
tty_vhangup(tty); tty_vhangup(tty);
} else { } else {
if (current->signal->tty_old_pgrp) { pid_t old_pgrp = current->signal->tty_old_pgrp;
kill_pg(current->signal->tty_old_pgrp, SIGHUP, on_exit); if (old_pgrp) {
kill_pg(current->signal->tty_old_pgrp, SIGCONT, on_exit); kill_pg(old_pgrp, SIGHUP, on_exit);
kill_pg(old_pgrp, SIGCONT, on_exit);
} }
mutex_unlock(&tty_mutex); mutex_unlock(&tty_mutex);
unlock_kernel(); unlock_kernel();
@ -1505,19 +1509,29 @@ void disassociate_ctty(int on_exit)
kill_pg(tty_pgrp, SIGCONT, on_exit); kill_pg(tty_pgrp, SIGCONT, on_exit);
} }
/* Must lock changes to tty_old_pgrp */ spin_lock_irq(&current->sighand->siglock);
mutex_lock(&tty_mutex);
current->signal->tty_old_pgrp = 0; current->signal->tty_old_pgrp = 0;
session = current->signal->session;
spin_unlock_irq(&current->sighand->siglock);
mutex_lock(&tty_mutex);
/* It is possible that do_tty_hangup has free'd this tty */
tty = get_current_tty();
if (tty) {
tty->session = 0; tty->session = 0;
tty->pgrp = -1; tty->pgrp = 0;
} else {
#ifdef TTY_DEBUG_HANGUP
printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
" = NULL", tty);
#endif
}
mutex_unlock(&tty_mutex);
/* Now clear signal->tty under the lock */ /* Now clear signal->tty under the lock */
read_lock(&tasklist_lock); read_lock(&tasklist_lock);
do_each_task_pid(current->signal->session, PIDTYPE_SID, p) { session_clear_tty(session);
p->signal->tty = NULL;
} while_each_task_pid(current->signal->session, PIDTYPE_SID, p);
read_unlock(&tasklist_lock); read_unlock(&tasklist_lock);
mutex_unlock(&tty_mutex);
unlock_kernel(); unlock_kernel();
} }
@ -2337,16 +2351,10 @@ static void release_dev(struct file * filp)
* tty. * tty.
*/ */
if (tty_closing || o_tty_closing) { if (tty_closing || o_tty_closing) {
struct task_struct *p;
read_lock(&tasklist_lock); read_lock(&tasklist_lock);
do_each_task_pid(tty->session, PIDTYPE_SID, p) { session_clear_tty(tty->session);
p->signal->tty = NULL;
} while_each_task_pid(tty->session, PIDTYPE_SID, p);
if (o_tty) if (o_tty)
do_each_task_pid(o_tty->session, PIDTYPE_SID, p) { session_clear_tty(o_tty->session);
p->signal->tty = NULL;
} while_each_task_pid(o_tty->session, PIDTYPE_SID, p);
read_unlock(&tasklist_lock); read_unlock(&tasklist_lock);
} }
@ -2443,9 +2451,9 @@ static void release_dev(struct file * filp)
* The termios state of a pty is reset on first open so that * The termios state of a pty is reset on first open so that
* settings don't persist across reuse. * settings don't persist across reuse.
* *
* Locking: tty_mutex protects current->signal->tty, get_tty_driver and * Locking: tty_mutex protects tty, get_tty_driver and init_dev work.
* init_dev work. tty->count should protect the rest. * tty->count should protect the rest.
* task_lock is held to update task details for sessions * ->siglock protects ->signal/->sighand
*/ */
static int tty_open(struct inode * inode, struct file * filp) static int tty_open(struct inode * inode, struct file * filp)
@ -2467,12 +2475,13 @@ static int tty_open(struct inode * inode, struct file * filp)
mutex_lock(&tty_mutex); mutex_lock(&tty_mutex);
if (device == MKDEV(TTYAUX_MAJOR,0)) { if (device == MKDEV(TTYAUX_MAJOR,0)) {
if (!current->signal->tty) { tty = get_current_tty();
if (!tty) {
mutex_unlock(&tty_mutex); mutex_unlock(&tty_mutex);
return -ENXIO; return -ENXIO;
} }
driver = current->signal->tty->driver; driver = tty->driver;
index = current->signal->tty->index; index = tty->index;
filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */ filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
/* noctty = 1; */ /* noctty = 1; */
goto got_driver; goto got_driver;
@ -2547,17 +2556,16 @@ static int tty_open(struct inode * inode, struct file * filp)
filp->f_op = &tty_fops; filp->f_op = &tty_fops;
goto retry_open; goto retry_open;
} }
mutex_lock(&tty_mutex);
spin_lock_irq(&current->sighand->siglock);
if (!noctty && if (!noctty &&
current->signal->leader && current->signal->leader &&
!current->signal->tty && !current->signal->tty &&
tty->session == 0) { tty->session == 0)
task_lock(current); __proc_set_tty(current, tty);
current->signal->tty = tty; spin_unlock_irq(&current->sighand->siglock);
task_unlock(current); mutex_unlock(&tty_mutex);
current->signal->tty_old_pgrp = 0;
tty->session = current->signal->session;
tty->pgrp = process_group(current);
}
return 0; return 0;
} }
@ -2747,7 +2755,7 @@ static int tiocsti(struct tty_struct *tty, char __user *p)
* *
* Copies the kernel idea of the window size into the user buffer. * Copies the kernel idea of the window size into the user buffer.
* *
* Locking: tty->termios_sem is taken to ensure the winsize data * Locking: tty->termios_mutex is taken to ensure the winsize data
* is consistent. * is consistent.
*/ */
@ -2774,8 +2782,8 @@ static int tiocgwinsz(struct tty_struct *tty, struct winsize __user * arg)
* Locking: * Locking:
* Called function use the console_sem is used to ensure we do * Called function use the console_sem is used to ensure we do
* not try and resize the console twice at once. * not try and resize the console twice at once.
* The tty->termios_sem is used to ensure we don't double * The tty->termios_mutex is used to ensure we don't double
* resize and get confused. Lock order - tty->termios.sem before * resize and get confused. Lock order - tty->termios_mutex before
* console sem * console sem
*/ */
@ -2880,25 +2888,28 @@ static int fionbio(struct file *file, int __user *p)
* leader to set this tty as the controlling tty for the session. * leader to set this tty as the controlling tty for the session.
* *
* Locking: * Locking:
* Takes tasklist lock internally to walk sessions
* Takes task_lock() when updating signal->tty
* Takes tty_mutex() to protect tty instance * Takes tty_mutex() to protect tty instance
* * Takes tasklist_lock internally to walk sessions
* Takes ->siglock() when updating signal->tty
*/ */
static int tiocsctty(struct tty_struct *tty, int arg) static int tiocsctty(struct tty_struct *tty, int arg)
{ {
struct task_struct *p; int ret = 0;
if (current->signal->leader && if (current->signal->leader &&
(current->signal->session == tty->session)) (current->signal->session == tty->session))
return 0; return ret;
mutex_lock(&tty_mutex);
/* /*
* The process must be a session leader and * The process must be a session leader and
* not have a controlling tty already. * not have a controlling tty already.
*/ */
if (!current->signal->leader || current->signal->tty) if (!current->signal->leader || current->signal->tty) {
return -EPERM; ret = -EPERM;
goto unlock;
}
if (tty->session > 0) { if (tty->session > 0) {
/* /*
* This tty is already the controlling * This tty is already the controlling
@ -2908,24 +2919,18 @@ static int tiocsctty(struct tty_struct *tty, int arg)
/* /*
* Steal it away * Steal it away
*/ */
read_lock(&tasklist_lock); read_lock(&tasklist_lock);
do_each_task_pid(tty->session, PIDTYPE_SID, p) { session_clear_tty(tty->session);
p->signal->tty = NULL;
} while_each_task_pid(tty->session, PIDTYPE_SID, p);
read_unlock(&tasklist_lock); read_unlock(&tasklist_lock);
} else } else {
return -EPERM; ret = -EPERM;
goto unlock;
} }
mutex_lock(&tty_mutex); }
task_lock(current); proc_set_tty(current, tty);
current->signal->tty = tty; unlock:
task_unlock(current);
mutex_unlock(&tty_mutex); mutex_unlock(&tty_mutex);
current->signal->tty_old_pgrp = 0; return ret;
tty->session = current->signal->session;
tty->pgrp = process_group(current);
return 0;
} }
/** /**
@ -2937,7 +2942,7 @@ static int tiocsctty(struct tty_struct *tty, int arg)
* Obtain the process group of the tty. If there is no process group * Obtain the process group of the tty. If there is no process group
* return an error. * return an error.
* *
* Locking: none. Reference to ->signal->tty is safe. * Locking: none. Reference to current->signal->tty is safe.
*/ */
static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p) static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
@ -2995,7 +3000,7 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
* Obtain the session id of the tty. If there is no session * Obtain the session id of the tty. If there is no session
* return an error. * return an error.
* *
* Locking: none. Reference to ->signal->tty is safe. * Locking: none. Reference to current->signal->tty is safe.
*/ */
static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p) static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
@ -3214,14 +3219,11 @@ int tty_ioctl(struct inode * inode, struct file * file,
clear_bit(TTY_EXCLUSIVE, &tty->flags); clear_bit(TTY_EXCLUSIVE, &tty->flags);
return 0; return 0;
case TIOCNOTTY: case TIOCNOTTY:
/* FIXME: taks lock or tty_mutex ? */
if (current->signal->tty != tty) if (current->signal->tty != tty)
return -ENOTTY; return -ENOTTY;
if (current->signal->leader) if (current->signal->leader)
disassociate_ctty(0); disassociate_ctty(0);
task_lock(current); proc_clear_tty(current);
current->signal->tty = NULL;
task_unlock(current);
return 0; return 0;
case TIOCSCTTY: case TIOCSCTTY:
return tiocsctty(tty, arg); return tiocsctty(tty, arg);
@ -3834,9 +3836,52 @@ int tty_unregister_driver(struct tty_driver *driver)
cdev_del(&driver->cdev); cdev_del(&driver->cdev);
return 0; return 0;
} }
EXPORT_SYMBOL(tty_unregister_driver); EXPORT_SYMBOL(tty_unregister_driver);
dev_t tty_devnum(struct tty_struct *tty)
{
return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
}
EXPORT_SYMBOL(tty_devnum);
void proc_clear_tty(struct task_struct *p)
{
spin_lock_irq(&p->sighand->siglock);
p->signal->tty = NULL;
spin_unlock_irq(&p->sighand->siglock);
}
EXPORT_SYMBOL(proc_clear_tty);
void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
{
if (tty) {
tty->session = tsk->signal->session;
tty->pgrp = process_group(tsk);
}
tsk->signal->tty = tty;
tsk->signal->tty_old_pgrp = 0;
}
void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
{
spin_lock_irq(&tsk->sighand->siglock);
__proc_set_tty(tsk, tty);
spin_unlock_irq(&tsk->sighand->siglock);
}
struct tty_struct *get_current_tty(void)
{
struct tty_struct *tty;
WARN_ON_ONCE(!mutex_is_locked(&tty_mutex));
tty = current->signal->tty;
/*
* session->tty can be changed/cleared from under us, make sure we
* issue the load. The obtained pointer, when not NULL, is valid as
* long as we hold tty_mutex.
*/
barrier();
return tty;
}
/* /*
* Initialize the console device. This is called *early*, so * Initialize the console device. This is called *early*, so

12
drivers/s390/char/fs3270.c
View file

@ -424,11 +424,15 @@ fs3270_open(struct inode *inode, struct file *filp)
minor = iminor(filp->f_dentry->d_inode); minor = iminor(filp->f_dentry->d_inode);
/* Check for minor 0 multiplexer. */ /* Check for minor 0 multiplexer. */
if (minor == 0) { if (minor == 0) {
if (!current->signal->tty) struct tty_struct *tty;
mutex_lock(&tty_mutex);
tty = get_current_tty();
if (!tty || tty->driver->major != IBM_TTY3270_MAJOR) {
mutex_unlock(&tty_mutex);
return -ENODEV; return -ENODEV;
if (current->signal->tty->driver->major != IBM_TTY3270_MAJOR) }
return -ENODEV; minor = tty->index + RAW3270_FIRSTMINOR;
minor = current->signal->tty->index + RAW3270_FIRSTMINOR; mutex_unlock(&tty_mutex);
} }
/* Check if some other program is already using fullscreen mode. */ /* Check if some other program is already using fullscreen mode. */
fp = (struct fs3270 *) raw3270_find_view(&fs3270_fn, minor); fp = (struct fs3270 *) raw3270_find_view(&fs3270_fn, minor);

14
fs/dquot.c
View file

@ -828,6 +828,7 @@ static inline int need_print_warning(struct dquot *dquot)
static void print_warning(struct dquot *dquot, const char warntype) static void print_warning(struct dquot *dquot, const char warntype)
{ {
char *msg = NULL; char *msg = NULL;
struct tty_struct *tty;
int flag = (warntype == BHARDWARN || warntype == BSOFTLONGWARN) ? DQ_BLKS_B : int flag = (warntype == BHARDWARN || warntype == BSOFTLONGWARN) ? DQ_BLKS_B :
((warntype == IHARDWARN || warntype == ISOFTLONGWARN) ? DQ_INODES_B : 0); ((warntype == IHARDWARN || warntype == ISOFTLONGWARN) ? DQ_INODES_B : 0);
@ -835,14 +836,15 @@ static void print_warning(struct dquot *dquot, const char warntype)
return; return;
mutex_lock(&tty_mutex); mutex_lock(&tty_mutex);
if (!current->signal->tty) tty = get_current_tty();
if (!tty)
goto out_lock; goto out_lock;
tty_write_message(current->signal->tty, dquot->dq_sb->s_id); tty_write_message(tty, dquot->dq_sb->s_id);
if (warntype == ISOFTWARN || warntype == BSOFTWARN) if (warntype == ISOFTWARN || warntype == BSOFTWARN)
tty_write_message(current->signal->tty, ": warning, "); tty_write_message(tty, ": warning, ");
else else
tty_write_message(current->signal->tty, ": write failed, "); tty_write_message(tty, ": write failed, ");
tty_write_message(current->signal->tty, quotatypes[dquot->dq_type]); tty_write_message(tty, quotatypes[dquot->dq_type]);
switch (warntype) { switch (warntype) {
case IHARDWARN: case IHARDWARN:
msg = " file limit reached.\r\n"; msg = " file limit reached.\r\n";
@ -863,7 +865,7 @@ static void print_warning(struct dquot *dquot, const char warntype)
msg = " block quota exceeded.\r\n"; msg = " block quota exceeded.\r\n";
break; break;
} }
tty_write_message(current->signal->tty, msg); tty_write_message(tty, msg);
out_lock: out_lock:
mutex_unlock(&tty_mutex); mutex_unlock(&tty_mutex);
} }

1
fs/open.c
View file

@ -1087,6 +1087,7 @@ EXPORT_SYMBOL(sys_close);
asmlinkage long sys_vhangup(void) asmlinkage long sys_vhangup(void)
{ {
if (capable(CAP_SYS_TTY_CONFIG)) { if (capable(CAP_SYS_TTY_CONFIG)) {
/* XXX: this needs locking */
tty_vhangup(current->signal->tty); tty_vhangup(current->signal->tty);
return 0; return 0;
} }

11
include/linux/tty.h
View file

@ -309,6 +309,12 @@ extern void tty_ldisc_flush(struct tty_struct *tty);
extern int tty_ioctl(struct inode *inode, struct file *file, unsigned int cmd, extern int tty_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
unsigned long arg); unsigned long arg);
extern dev_t tty_devnum(struct tty_struct *tty);
extern void proc_clear_tty(struct task_struct *p);
extern void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
extern void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
extern struct tty_struct *get_current_tty(void);
extern struct mutex tty_mutex; extern struct mutex tty_mutex;
/* n_tty.c */ /* n_tty.c */
@ -335,10 +341,5 @@ extern void console_print(const char *);
extern int vt_ioctl(struct tty_struct *tty, struct file * file, extern int vt_ioctl(struct tty_struct *tty, struct file * file,
unsigned int cmd, unsigned long arg); unsigned int cmd, unsigned long arg);
static inline dev_t tty_devnum(struct tty_struct *tty)
{
return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
}
#endif /* __KERNEL__ */ #endif /* __KERNEL__ */
#endif #endif

9
kernel/acct.c
View file

@ -428,6 +428,7 @@ static void do_acct_process(struct file *file)
u64 elapsed; u64 elapsed;
u64 run_time; u64 run_time;
struct timespec uptime; struct timespec uptime;
struct tty_struct *tty;
/* /*
* First check to see if there is enough free_space to continue * First check to see if there is enough free_space to continue
@ -485,12 +486,8 @@ static void do_acct_process(struct file *file)
#endif #endif
mutex_lock(&tty_mutex); mutex_lock(&tty_mutex);
/* FIXME: Whoever is responsible for current->signal locking needs tty = get_current_tty();
to use the same locking all over the kernel and document it */ ac.ac_tty = tty ? old_encode_dev(tty_devnum(tty)) : 0;
read_lock(&tasklist_lock);
ac.ac_tty = current->signal->tty ?
old_encode_dev(tty_devnum(current->signal->tty)) : 0;
read_unlock(&tasklist_lock);
mutex_unlock(&tty_mutex); mutex_unlock(&tty_mutex);
spin_lock_irq(&current->sighand->siglock); spin_lock_irq(&current->sighand->siglock);

2
kernel/auditsc.c
View file

@ -826,10 +826,12 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
context->return_code); context->return_code);
mutex_lock(&tty_mutex); mutex_lock(&tty_mutex);
read_lock(&tasklist_lock);
if (tsk->signal && tsk->signal->tty && tsk->signal->tty->name) if (tsk->signal && tsk->signal->tty && tsk->signal->tty->name)
tty = tsk->signal->tty->name; tty = tsk->signal->tty->name;
else else
tty = "(none)"; tty = "(none)";
read_unlock(&tasklist_lock);
audit_log_format(ab, audit_log_format(ab,
" a0=%lx a1=%lx a2=%lx a3=%lx items=%d" " a0=%lx a1=%lx a2=%lx a3=%lx items=%d"
" ppid=%d pid=%d auid=%u uid=%u gid=%u" " ppid=%d pid=%d auid=%u uid=%u gid=%u"

4
kernel/exit.c
View file

@ -384,9 +384,7 @@ void daemonize(const char *name, ...)
exit_mm(current); exit_mm(current);
set_special_pids(1, 1); set_special_pids(1, 1);
mutex_lock(&tty_mutex); proc_clear_tty(current);
current->signal->tty = NULL;
mutex_unlock(&tty_mutex);
/* Block and flush all signals */ /* Block and flush all signals */
sigfillset(&blocked); sigfillset(&blocked);

6
kernel/sys.c
View file

@ -1484,7 +1484,6 @@ asmlinkage long sys_setsid(void)
pid_t session; pid_t session;
int err = -EPERM; int err = -EPERM;
mutex_lock(&tty_mutex);
write_lock_irq(&tasklist_lock); write_lock_irq(&tasklist_lock);
/* Fail if I am already a session leader */ /* Fail if I am already a session leader */
@ -1504,12 +1503,15 @@ asmlinkage long sys_setsid(void)
group_leader->signal->leader = 1; group_leader->signal->leader = 1;
__set_special_pids(session, session); __set_special_pids(session, session);
spin_lock(&group_leader->sighand->siglock);
group_leader->signal->tty = NULL; group_leader->signal->tty = NULL;
group_leader->signal->tty_old_pgrp = 0; group_leader->signal->tty_old_pgrp = 0;
spin_unlock(&group_leader->sighand->siglock);
err = process_group(group_leader); err = process_group(group_leader);
out: out:
write_unlock_irq(&tasklist_lock); write_unlock_irq(&tasklist_lock);
mutex_unlock(&tty_mutex);
return err; return err;
} }

11
security/selinux/hooks.c
View file

@ -1695,9 +1695,10 @@ static inline void flush_unauthorized_files(struct files_struct * files)
struct tty_struct *tty; struct tty_struct *tty;
struct fdtable *fdt; struct fdtable *fdt;
long j = -1; long j = -1;
int drop_tty = 0;
mutex_lock(&tty_mutex); mutex_lock(&tty_mutex);
tty = current->signal->tty; tty = get_current_tty();
if (tty) { if (tty) {
file_list_lock(); file_list_lock();
file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list); file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
@ -1710,12 +1711,14 @@ static inline void flush_unauthorized_files(struct files_struct * files)
struct inode *inode = file->f_dentry->d_inode; struct inode *inode = file->f_dentry->d_inode;
if (inode_has_perm(current, inode, if (inode_has_perm(current, inode,
FILE__READ | FILE__WRITE, NULL)) { FILE__READ | FILE__WRITE, NULL)) {
/* Reset controlling tty. */ drop_tty = 1;
current->signal->tty = NULL;
current->signal->tty_old_pgrp = 0;
} }
} }
file_list_unlock(); file_list_unlock();
/* Reset controlling tty. */
if (drop_tty)
proc_set_tty(current, NULL);
} }
mutex_unlock(&tty_mutex); mutex_unlock(&tty_mutex);