summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorgordon <gordon@FreeBSD.org>2019-07-24 12:53:06 +0000
committergordon <gordon@FreeBSD.org>2019-07-24 12:53:06 +0000
commitaae64a845b6024a348ac03faab07830ca176c2cb (patch)
treeb70d3ecb1ccde772be83c8dc166c7f357c3a102a
parentc9864bb82da03e4c9da220a9196275bbdfb72cc5 (diff)
downloadFreeBSD-src-aae64a845b6024a348ac03faab07830ca176c2cb.zip
FreeBSD-src-aae64a845b6024a348ac03faab07830ca176c2cb.tar.gz
Fix pts write-after-free.
Approved by: so Security: FreeBSD-SA-19:13.pts Security: CVE-2019-5606
-rw-r--r--sys/kern/tty.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/kern/tty.c b/sys/kern/tty.c
index b0a535c..210d91d 100644
--- a/sys/kern/tty.c
+++ b/sys/kern/tty.c
@@ -230,9 +230,6 @@ ttydev_leave(struct tty *tp)
tp->t_flags |= TF_OPENCLOSE;
- /* Stop asynchronous I/O. */
- funsetown(&tp->t_sigio);
-
/* Remove console TTY. */
if (constty == tp)
constty_clear();
@@ -1123,6 +1120,9 @@ tty_rel_free(struct tty *tp)
return;
}
+ /* Stop asynchronous I/O. */
+ funsetown(&tp->t_sigio);
+
/* TTY can be deallocated. */
dev = tp->t_dev;
tp->t_dev = NULL;
OpenPOWER on IntegriCloud