From 3c32f2a5eff1943c7f8cebb492f3a8570c49a7cc Mon Sep 17 00:00:00 2001 From: gordon Date: Wed, 24 Jul 2019 12:53:06 +0000 Subject: [PATCH] Fix pts write-after-free. Approved by: so Security: FreeBSD-SA-19:13.pts Security: CVE-2019-5606 --- sys/kern/tty.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/sys/kern/tty.c b/sys/kern/tty.c index b0a535cb67e..2ae3aa57a14 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -230,9 +230,6 @@ ttydev_leave(struct tty *tp) tp->t_flags |= TF_OPENCLOSE; - /* Stop asynchronous I/O. */ - funsetown(&tp->t_sigio); - /* Remove console TTY. */ if (constty == tp) constty_clear(); @@ -1123,6 +1120,12 @@ tty_rel_free(struct tty *tp) return; } + /* Stop asynchronous I/O. */ + funsetown(&tp->t_sigio); + + /* Stop asynchronous I/O. */ + funsetown(&tp->t_sigio); + /* TTY can be deallocated. */ dev = tp->t_dev; tp->t_dev = NULL; -- 2.45.0