From 16ca3698609cbcaa27863087200e44573dab8e32 Mon Sep 17 00:00:00 2001 From: Alexander Viro Date: Tue, 21 Oct 2003 18:44:21 -0700 Subject: [PATCH] [PATCH] fix for do_tty_hangup() access of kfreed memory do_tty_hangup() does fput() on redirect struct file too early - it could've been the only holder of tty_struct we are working with and in that case we'll end up freeing it from fput() and then both reading and modifying kfreed memory. --- drivers/char/tty_io.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c index 09868cc3da788..f68efa6f4e5ff 100644 --- a/drivers/char/tty_io.c +++ b/drivers/char/tty_io.c @@ -423,8 +423,6 @@ void do_tty_hangup(void *data) redirect = NULL; } spin_unlock(&redirect_lock); - if (f) - fput(f); check_tty_count(tty, "do_tty_hangup"); file_list_lock(); @@ -512,6 +510,8 @@ void do_tty_hangup(void *data) } else if (tty->driver->hangup) (tty->driver->hangup)(tty); unlock_kernel(); + if (f) + fput(f); } void tty_hangup(struct tty_struct * tty) -- 2.53.0