Messages in this thread Patch in this message |  | | Date | Thu, 4 Sep 2008 15:35:42 +0100 | | From | Alan Cox <> | | Subject | Re: linux-next: Tree for September 3 |
| |
> I cannot revert tty-kref-get-current-tty and I can't immediately spot > the bug in it.
Nailed it; magic ingredient is SELinux inclusion which then triggers a leak on a flush unauthorized
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c index d18e6d2..3ef5425 100644 --- a/drivers/s390/char/fs3270.c +++ b/drivers/s390/char/fs3270.c @@ -430,11 +430,12 @@ fs3270_open(struct inode *inode, struct file *filp) mutex_lock(&tty_mutex); tty = get_current_tty(); if (!tty || tty->driver->major != IBM_TTY3270_MAJOR) { - mutex_unlock(&tty_mutex); + tty_kref_put(tty); rc = -ENODEV; goto out; } minor = tty->index + RAW3270_FIRSTMINOR; + tty_kref_put(tty); mutex_unlock(&tty_mutex); } /* Check if some other program is already using fullscreen mode. */ diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 03fc6a8..c856db8 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2122,6 +2122,7 @@ static inline void flush_unauthorized_files(struct files_struct *files) mutex_lock(&tty_mutex); tty = get_current_tty(); + mutex_unlock(&tty_mutex); if (tty) { file_list_lock(); file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list); @@ -2138,8 +2139,8 @@ static inline void flush_unauthorized_files(struct files_struct *files) } } file_list_unlock(); + tty_kref_put(tty); } - mutex_unlock(&tty_mutex); /* Reset controlling tty. */ if (drop_tty) no_tty();
|  |