diff options
author | Chen Tingjie <tingjie.chen@intel.com> | 2014-04-15 11:52:51 +0800 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-04-16 14:31:13 -0700 |
commit | c70dbb1e79a1ac2802b4b7b6de7456b230fbbbeb (patch) | |
tree | 5ecb61ba932bb1cdefdee633a02bd896ceade4f6 /drivers | |
parent | b24313a82cf24e90170671ea74360b3e6ef3a91f (diff) | |
download | op-kernel-dev-c70dbb1e79a1ac2802b4b7b6de7456b230fbbbeb.zip op-kernel-dev-c70dbb1e79a1ac2802b4b7b6de7456b230fbbbeb.tar.gz |
tty: fix memleak in alloc_pid
There is memleak in alloc_pid:
------------------------------
unreferenced object 0xd3453a80 (size 64):
comm "adbd", pid 1730, jiffies 66363 (age 6586.950s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 c2 f6 d5 00 d3 25 c1 59 28 00 00 ....@.....%.Y(..
backtrace:
[<c1a6f15c>] kmemleak_alloc+0x3c/0xa0
[<c1320546>] kmem_cache_alloc+0xc6/0x190
[<c125d51e>] alloc_pid+0x1e/0x400
[<c123d344>] copy_process.part.39+0xad4/0x1120
[<c123da59>] do_fork+0x99/0x330
[<c123dd58>] sys_fork+0x28/0x30
[<c1a89a08>] syscall_call+0x7/0xb
[<ffffffff>] 0xffffffff
the leak is due to unreleased pid->count, which execute in function:
get_pid()(pid->count++) and put_pid()(pid->count--).
The race condition as following:
task[dumpsys] task[adbd]
in disassociate_ctty() in tty_signal_session_leader()
----------------------- -------------------------
tty = get_current_tty();
// tty is not NULL
...
spin_lock_irq(¤t->sighand->siglock);
put_pid(current->signal->tty_old_pgrp);
current->signal->tty_old_pgrp = NULL;
spin_unlock_irq(¤t->sighand->siglock);
spin_lock_irq(&p->sighand->siglock);
...
p->signal->tty = NULL;
...
spin_unlock_irq(&p->sighand->siglock);
tty = get_current_tty();
// tty NULL, goto else branch by accident.
if (tty) {
...
put_pid(tty_session);
put_pid(tty_pgrp);
...
} else {
print msg
}
in task[dumpsys], in disassociate_ctty(), tty is set NULL by task[adbd],
tty_signal_session_leader(), then it goto else branch and lack of
put_pid(), cause memleak.
move spin_unlock(sighand->siglock) after get_current_tty() can avoid
the race and fix the memleak.
Signed-off-by: Zhang Jun <jun.zhang@intel.com>
Signed-off-by: Chen Tingjie <tingjie.chen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/tty/tty_io.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index d3448a9..3411071 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -878,9 +878,8 @@ void disassociate_ctty(int on_exit) spin_lock_irq(¤t->sighand->siglock); put_pid(current->signal->tty_old_pgrp); current->signal->tty_old_pgrp = NULL; - spin_unlock_irq(¤t->sighand->siglock); - tty = get_current_tty(); + tty = tty_kref_get(current->signal->tty); if (tty) { unsigned long flags; spin_lock_irqsave(&tty->ctrl_lock, flags); @@ -897,6 +896,7 @@ void disassociate_ctty(int on_exit) #endif } + spin_unlock_irq(¤t->sighand->siglock); /* Now clear signal->tty under the lock */ read_lock(&tasklist_lock); session_clear_tty(task_session(current)); |