svn commit: r361358 - stable/10/sys/kern

[Hans Petter Selasky]

Author: hselasky
Date: Fri May 22 09:01:26 2020
New Revision: 361358
URL: https://svnweb.freebsd.org/changeset/base/361358

Log:
  MFC r361075:
  Assign process group of the TTY under the "proctree_lock".
  
  This fixes a race where concurrent calls to doenterpgrp() and
  leavepgrp() while TIOCSCTTY is executing may result in tp->t_pgrp
  changing value so that tty_rel_pgrp() misses clearing it to NULL. For
  more details refer to the use of pgdelete() in the kernel.
  
  No functional change intended.
  
  Panic backtrace:
  __mtx_lock_sleep() # page fault due to using destroyed mutex
  tty_signal_pgrp()
  tty_ioctl()
  ptsdev_ioctl()
  kern_ioctl()
  sys_ioctl()
  amd64_syscall()
  
  Sponsored by:	Mellanox Technologies

Modified:
  stable/10/sys/kern/tty.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/kern/tty.c
==============================================================================
--- stable/10/sys/kern/tty.c	Fri May 22 09:00:22 2020	(r361357)
+++ stable/10/sys/kern/tty.c	Fri May 22 09:01:26 2020	(r361358)
@@ -1721,7 +1721,6 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *da
 		tp->t_session = p->p_session;
 		tp->t_session->s_ttyp = tp;
 		tp->t_sessioncnt++;
-		sx_xunlock(&proctree_lock);
 
 		/* Assign foreground process group. */
 		tp->t_pgrp = p->p_pgrp;
@@ -1729,6 +1728,7 @@ tty_generic_ioctl(struct tty *tp, u_long cmd, void *da
 		p->p_flag |= P_CONTROLT;
 		PROC_UNLOCK(p);
 
+		sx_xunlock(&proctree_lock);
 		return (0);
 	}
 	case TIOCSPGRP: {