RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 02:47:34 +00:00
Code Issues Activity Actions

Kernel: Store TTY's foreground process as a WeakPtr<Process>

Browse source 
This ensures that we don't leave a stale PGID assigned to the TTY after
the process exits, which would make PID recycling attacks possible.
This commit is contained in:
Andreas Kling 2020-08-06 11:17:53 +02:00
parent ff01cfa08a
commit ddab7ab693
3 changed files with 22 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

10
Kernel/Process.h
View file

@ -35,6 +35,7 @@
#include <AK/String.h>
#include <AK/Userspace.h>
#include <AK/WeakPtr.h>
#include <AK/Weakable.h>
#include <Kernel/API/Syscall.h>
#include <Kernel/FileSystem/InodeMetadata.h>
#include <Kernel/Forward.h>
@ -106,7 +107,11 @@ struct UnveiledPath {
unsigned permissions { 0 };
};
class Process : public RefCounted<Process>, public InlineLinkedListNode<Process> {
class Process
: public RefCounted<Process>
, public InlineLinkedListNode<Process>
, public Weakable<Process> {
AK_MAKE_NONCOPYABLE(Process);
AK_MAKE_NONMOVABLE(Process);
@ -453,7 +458,8 @@ public:
[[nodiscard]] String validate_and_copy_string_from_user(Userspace<const char*> user_characters, size_t size) const
{
return validate_and_copy_string_from_user(user_characters.unsafe_userspace_ptr(), size); }
return validate_and_copy_string_from_user(user_characters.unsafe_userspace_ptr(), size);
}
[[nodiscard]] String validate_and_copy_string_from_user(const Syscall::StringArgument&) const;

16
Kernel/TTY/TTY.cpp
View file

@ -155,9 +155,9 @@ void TTY::emit(u8 ch)
if (ch == m_termios.c_cc[VSUSP]) {
dbg() << tty_name() << ": VSUSP pressed!";
generate_signal(SIGTSTP);
if (auto process = Process::from_pid(m_pgid)) {
if (auto parent = Process::from_pid(process->ppid()))
(void)parent->send_signal(SIGCHLD, process);
if (m_process) {
if (auto parent = Process::from_pid(m_process->ppid()))
(void)parent->send_signal(SIGCHLD, m_process);
}
return;
}
@ -304,7 +304,7 @@ int TTY::ioctl(FileDescription&, unsigned request, FlatPtr arg)
#endif
switch (request) {
case TIOCGPGRP:
return m_pgid;
return this->pgid();
case TIOCSPGRP:
pgid = static_cast<pid_t>(arg);
if (pgid <= 0)
@ -318,8 +318,8 @@ int TTY::ioctl(FileDescription&, unsigned request, FlatPtr arg)
return -EPERM;
if (current_process.sid() != process->sid())
return -EPERM;
m_process = process->make_weak_ptr();
}
m_pgid = pgid;
return 0;
case TCGETS: {
user_termios = reinterpret_cast<termios*>(arg);
@ -394,4 +394,10 @@ void TTY::hang_up()
{
generate_signal(SIGHUP);
}
pid_t TTY::pgid() const
{
return m_process ? m_process->pgid() : 0;
}
}

8
Kernel/TTY/TTY.h
View file

@ -27,14 +27,13 @@
#pragma once
#include <AK/CircularDeque.h>
#include <AK/WeakPtr.h>
#include <Kernel/Devices/CharacterDevice.h>
#include <Kernel/DoubleBuffer.h>
#include <Kernel/UnixTypes.h>
namespace Kernel {
class Process;
class TTY : public CharacterDevice {
public:
virtual ~TTY() override;
@ -51,8 +50,7 @@ public:
unsigned short rows() const { return m_rows; }
unsigned short columns() const { return m_columns; }
void set_pgid(pid_t pgid) { m_pgid = pgid; }
pid_t pgid() const { return m_pgid; }
pid_t pgid() const;
void set_termios(const termios&);
bool should_generate_signals() const { return m_termios.c_lflag & ISIG; }
@ -93,7 +91,7 @@ private:
virtual bool is_tty() const final override { return true; }
CircularDeque<u8, 1024> m_input_buffer;
pid_t m_pgid { 0 };
WeakPtr<Process> m_process;
termios m_termios;
unsigned short m_rows { 0 };
unsigned short m_columns { 0 };