Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752503AbbF1QHX (ORCPT ); Sun, 28 Jun 2015 12:07:23 -0400 Received: from mail-qk0-f169.google.com ([209.85.220.169]:32825 "EHLO mail-qk0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751445AbbF1QHR (ORCPT ); Sun, 28 Jun 2015 12:07:17 -0400 Message-ID: <55901BB2.8030808@hurleysoftware.com> Date: Sun, 28 Jun 2015 12:07:14 -0400 From: Peter Hurley User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: Patrick Donnelly CC: Greg Kroah-Hartman , Jiri Slaby , open list Subject: Re: [PATCH v2 2/2] tty: check tcsetpgrp p is a process group References: <1435439824-3975-1-git-send-email-batrick@batbytes.com> <1435452689-25390-1-git-send-email-batrick@batbytes.com> <1435452689-25390-2-git-send-email-batrick@batbytes.com> In-Reply-To: <1435452689-25390-2-git-send-email-batrick@batbytes.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1472 Lines: 43 On 06/27/2015 08:51 PM, Patrick Donnelly wrote: > This fixes a bug where a process can set the foreground process group to its > pid even if its pid is not a valid pgrp. > > Signed-off-by: Patrick Donnelly > --- > drivers/tty/tty_io.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c > index fbb55db..01b4769 100644 > --- a/drivers/tty/tty_io.c > +++ b/drivers/tty/tty_io.c > @@ -2579,6 +2579,9 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t > retval = -ESRCH; > if (!pgrp) > goto out_unlock; > + retval = -EINVAL; > + if (!pid_task(pgrp, PIDTYPE_PGID)) > + goto out_unlock; This change implies that the sequence in session_of_pgrp() that specifically checks for pid_task(pgrp, PIDTYPE_PGID) == NULL is not doing anything useful. However, that hypothesis is directly contradicted by the comment above session_of_pgrp() "* This checks not only the pgrp, but falls back on the pid if no * satisfactory pgrp is found. I dunno - gdb doesn't work correctly * without this..." Regards, Peter Hurley > retval = -EPERM; > if (session_of_pgrp(pgrp) != task_session(current)) > goto out_unlock; > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/