git: a3ec3054762f - releng/14.0 - kern: fix panic with disabled ttys

The branch releng/14.0 has been updated by gordon:

URL: https://cgit.FreeBSD.org/src/commit/?id=a3ec3054762f0e7bf2381a7939e62c5e43fde935

commit a3ec3054762f0e7bf2381a7939e62c5e43fde935
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2024-02-26 15:38:45 +0000
Commit:     Gordon Tetlow <gordon@FreeBSD.org>
CommitDate: 2024-03-28 03:12:16 +0000

    kern: fix panic with disabled ttys
    
    PR: 277240, 277329
    Reviewed by: kib (earlier version)
    Fixes: f1d0a0cbecf2 ("jail: Fix information leak.")
    MFC after: 3 days
    Sponsored by: The FreeBSD Foundation
    Differential Revision: https://reviews.freebsd.org/D44086
    Approved by:    so
    Security:       FreeBSD-EN-24:05.tty
    
    (cherry picked from commit 975d7730828a8bde28c2a0092b6e95c4c4e22f34)
    (cherry picked from commit 8d22744f5be165a2a82a2a204789e44bbdc5a2ee)
---
 sys/kern/tty.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/sys/kern/tty.c b/sys/kern/tty.c
index 673904570b86..df42c08d949e 100644
--- a/sys/kern/tty.c
+++ b/sys/kern/tty.c
@@ -1312,7 +1312,8 @@ sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
 	struct xtty *xtlist, *xt;
 	struct tty *tp;
 	struct proc *p;
-	int cansee, error;
+	int error;
+	bool cansee;
 
 	sx_slock(&tty_list_sx);
 	lsize = tty_list_count * sizeof(struct xtty);
@@ -1325,8 +1326,8 @@ sysctl_kern_ttys(SYSCTL_HANDLER_ARGS)
 
 	TAILQ_FOREACH(tp, &tty_list, t_list) {
 		tty_lock(tp);
-		if (tp->t_session != NULL) {
-			p = tp->t_session->s_leader;
+		if (tp->t_session != NULL &&
+		    (p = atomic_load_ptr(&tp->t_session->s_leader)) != NULL) {
 			PROC_LOCK(p);
 			cansee = (p_cansee(td, p) == 0);
 			PROC_UNLOCK(p);