From aae64a845b6024a348ac03faab07830ca176c2cb Mon Sep 17 00:00:00 2001 From: gordon Date: Wed, 24 Jul 2019 12:53:06 +0000 Subject: [PATCH] Fix pts write-after-free. Approved by: so Security: FreeBSD-SA-19:13.pts Security: CVE-2019-5606 --- sys/kern/tty.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sys/kern/tty.c b/sys/kern/tty.c index b0a535cb67e..210d91d83b4 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -230,9 +230,6 @@ ttydev_leave(struct tty *tp) tp->t_flags |= TF_OPENCLOSE; - /* Stop asynchronous I/O. */ - funsetown(&tp->t_sigio); - /* Remove console TTY. */ if (constty == tp) constty_clear(); @@ -1123,6 +1120,9 @@ tty_rel_free(struct tty *tp) return; } + /* Stop asynchronous I/O. */ + funsetown(&tp->t_sigio); + /* TTY can be deallocated. */ dev = tp->t_dev; tp->t_dev = NULL; -- 2.45.0