diff options
author | gordon <gordon@FreeBSD.org> | 2019-07-24 12:53:06 +0000 |
---|---|---|
committer | gordon <gordon@FreeBSD.org> | 2019-07-24 12:53:06 +0000 |
commit | aae64a845b6024a348ac03faab07830ca176c2cb (patch) | |
tree | b70d3ecb1ccde772be83c8dc166c7f357c3a102a | |
parent | c9864bb82da03e4c9da220a9196275bbdfb72cc5 (diff) | |
download | FreeBSD-src-aae64a845b6024a348ac03faab07830ca176c2cb.zip FreeBSD-src-aae64a845b6024a348ac03faab07830ca176c2cb.tar.gz |
Fix pts write-after-free.
Approved by: so
Security: FreeBSD-SA-19:13.pts
Security: CVE-2019-5606
-rw-r--r-- | sys/kern/tty.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/kern/tty.c b/sys/kern/tty.c index b0a535c..210d91d 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -230,9 +230,6 @@ ttydev_leave(struct tty *tp) tp->t_flags |= TF_OPENCLOSE; - /* Stop asynchronous I/O. */ - funsetown(&tp->t_sigio); - /* Remove console TTY. */ if (constty == tp) constty_clear(); @@ -1123,6 +1120,9 @@ tty_rel_free(struct tty *tp) return; } + /* Stop asynchronous I/O. */ + funsetown(&tp->t_sigio); + /* TTY can be deallocated. */ dev = tp->t_dev; tp->t_dev = NULL; |