> I cannot revert tty-kref-get-current-tty and I can't immediately spot
> the bug in it.
Nailed it; magic ingredient is SELinux inclusion which then triggers a
leak on a flush unauthorized
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index d18e6d2..3ef5425 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -430,11 +430,12 @@ fs3270_open(struct inode *inode, struct file *filp)
mutex_lock(&tty_mutex);
tty = get_current_tty();
if (!tty || tty->driver->major != IBM_TTY3270_MAJOR) {
- mutex_unlock(&tty_mutex);
+ tty_kref_put(tty);
rc = -ENODEV;
goto out;
}
minor = tty->index + RAW3270_FIRSTMINOR;
+ tty_kref_put(tty);
mutex_unlock(&tty_mutex);
}
/* Check if some other program is already using fullscreen mode. */
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 03fc6a8..c856db8 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2122,6 +2122,7 @@ static inline void flush_unauthorized_files(struct files_struct *files)
mutex_lock(&tty_mutex);
tty = get_current_tty();
+ mutex_unlock(&tty_mutex);
if (tty) {
file_list_lock();
file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
@@ -2138,8 +2139,8 @@ static inline void flush_unauthorized_files(struct files_struct *files)
}
}
file_list_unlock();
+ tty_kref_put(tty);
}
- mutex_unlock(&tty_mutex);
/* Reset controlling tty. */
if (drop_tty)
no_tty();
--
To unsubscribe from this list: send the line "unsubscribe linux-next" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
