Re: [PATCH] pty: fix use after free of tty->driver_data

[Herton R. Krzesinski]

On Tue, Dec 15, 2015 at 04:05:09PM -0200, Herton R. Krzesinski wrote:
> On Tue, Dec 15, 2015 at 09:36:26AM -0800, Peter Hurley wrote:
> > 
> > 
> > > Signed-off-by: Herton R. Krzesinski <herton@xxxxxxxxxx>
> > > Cc: <stable@xxxxxxxxxxxxxxx>
> > 
> > Afaict, the stable tag goes back to the original implementation.
> > Did you research how far back the /dev/tty alias problem goes?
> 
> Hmm no. I did cc stable because the first report I got about this issue
> was on RHEL 7 with 3.10 based kernel, so this issue goes far back
> some releases that are still supported and similar code is there.
> 
> On a quick check on a 2.6.32 kernel, things were very different,
> tty_release_dev() called directly devpts_kill_index with inode
> from the same file being closed. I'll check more and adjust the tag.

FYI, checked here and the problem should start with 3.8, after commit
fa2ecfc5a68d85624bbd84f7d010860776b7e602 devpts_kill_index was moved
to pty.c/pty_unix98_shutdown

-- 
[]'s
Herton
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/