From f3195cc08ccc99365ec00900a3c1abc59ceefc9c Mon Sep 17 00:00:00 2001 From: Ed Maste Date: Mon, 26 Feb 2024 10:38:45 -0500 Subject: [PATCH] kern: fix panic with disabled ttys PR: 277240, 277329 Reviewed by: kib (earlier version) Fixes: f1d0a0cbecf2 ("jail: Fix information leak.") MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D44086 Approved by: so Security: FreeBSD-EN-24:05.tty (cherry picked from commit 975d7730828a8bde28c2a0092b6e95c4c4e22f34) (cherry picked from commit 8d22744f5be165a2a82a2a204789e44bbdc5a2ee) (cherry picked from commit a60220bbb5511469fe53fd4290713ba891f8f48a) --- sys/kern/tty.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/sys/kern/tty.c b/sys/kern/tty.c index 22c4bb6dffc..92dee3ceefc 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -1314,7 +1314,8 @@ sysctl_kern_ttys(SYSCTL_HANDLER_ARGS) struct xtty *xtlist, *xt; struct tty *tp; struct proc *p; - int cansee, error; + int error; + bool cansee; sx_slock(&tty_list_sx); lsize = tty_list_count * sizeof(struct xtty); @@ -1327,8 +1328,8 @@ sysctl_kern_ttys(SYSCTL_HANDLER_ARGS) TAILQ_FOREACH(tp, &tty_list, t_list) { tty_lock(tp); - if (tp->t_session != NULL) { - p = tp->t_session->s_leader; + if (tp->t_session != NULL && + (p = atomic_load_ptr(&tp->t_session->s_leader)) != NULL) { PROC_LOCK(p); cansee = (p_cansee(td, p) == 0); PROC_UNLOCK(p); -- 2.45.0