lkml.org 
[lkml]   [2015]   [Dec]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH] pty: fix use after free of tty->driver_data
    From
    Date
    On 12/15/2015 11:23 AM, Herton R. Krzesinski wrote:
    > On Tue, Dec 15, 2015 at 04:05:09PM -0200, Herton R. Krzesinski wrote:
    >> On Tue, Dec 15, 2015 at 09:36:26AM -0800, Peter Hurley wrote:
    >>>
    >>>
    >>>> Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
    >>>> Cc: <stable@vger.kernel.org>
    >>>
    >>> Afaict, the stable tag goes back to the original implementation.
    >>> Did you research how far back the /dev/tty alias problem goes?
    >>
    >> Hmm no. I did cc stable because the first report I got about this issue
    >> was on RHEL 7 with 3.10 based kernel, so this issue goes far back
    >> some releases that are still supported and similar code is there.
    >>
    >> On a quick check on a 2.6.32 kernel, things were very different,
    >> tty_release_dev() called directly devpts_kill_index with inode
    >> from the same file being closed. I'll check more and adjust the tag.
    >
    > FYI, checked here and the problem should start with 3.8, after commit
    > fa2ecfc5a68d85624bbd84f7d010860776b7e602 devpts_kill_index was moved
    > to pty.c/pty_unix98_shutdown
    >

    istm this goes back to multi-instance devpts support added in 2.6.28.

    Before then, there was no inode parameter because there was only
    one devpts instance and the idas were global.



    \
     
     \ /
      Last update: 2015-12-15 21:01    [W:5.748 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site