git: 0a2f49823402 - main - tty: fix a panic with INVARIANTS

The branch main has been updated by rew:

URL: https://cgit.FreeBSD.org/src/commit/?id=0a2f498234023008d9a3b13ad7fc8fd81d384bab

commit 0a2f498234023008d9a3b13ad7fc8fd81d384bab
Author:     Robert Wing <rew@FreeBSD.org>
AuthorDate: 2022-02-22 18:22:18 +0000
Commit:     Robert Wing <rew@FreeBSD.org>
CommitDate: 2022-02-22 18:37:13 +0000

    tty: fix a panic with INVARIANTS
    
    watch'ing a tty triggers a refcount wraparound panic, take a reference
    on fp after fget_cap_locked() to fix.
    
    Reported by:    Michael Jung <mikej_at_paymentallianceintl.com>
    Reviewed by:    hselasky, mjg
    Fixes:          f40dd6c8034b ("tty: switch ttyhook_register to use fget_cap_locked")
    Differential Revision:  https://reviews.freebsd.org/D34335
---
 sys/kern/tty.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/kern/tty.c b/sys/kern/tty.c
index ebb32f698e88..9e6cd8d317cc 100644
--- a/sys/kern/tty.c
+++ b/sys/kern/tty.c
@@ -2083,6 +2083,8 @@ ttyhook_register(struct tty **rtp, struct proc *p, int fd, struct ttyhook *th,
 	FILEDESC_SLOCK(fdp);
 	error = fget_cap_locked(fdp, fd, cap_rights_init_one(&rights, CAP_TTYHOOK),
 	    &fp, NULL);
+	if (error == 0 && !fhold(fp))
+		error = EBADF;
 	FILEDESC_SUNLOCK(fdp);
 	if (error != 0)
 		return (error);