The branch main has been updated by mjg: URL: https://cgit.FreeBSD.org/src/commit/?id=f40dd6c8034be8c3c6db3d98bdc944a70c1248ad
commit f40dd6c8034be8c3c6db3d98bdc944a70c1248ad Author: Mateusz Guzik <[email protected]> AuthorDate: 2022-02-11 12:00:25 +0000 Commit: Mateusz Guzik <[email protected]> CommitDate: 2022-02-11 12:13:27 +0000 tty: switch ttyhook_register to use fget_cap_locked It is still wrong-ish as fget* funcs don't expect to operate on abitrary file descriptor tables, but this at least moves it out of the way of an upcoming change while being bug-compatible. --- sys/kern/tty.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/sys/kern/tty.c b/sys/kern/tty.c index 8dfe5e93780f..ebb32f698e88 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -2074,9 +2074,16 @@ ttyhook_register(struct tty **rtp, struct proc *p, int fd, struct ttyhook *th, int error, ref; /* Validate the file descriptor. */ + /* + * XXX this code inspects a file descriptor from a different process, + * but there is no dedicated routine to do it in fd code, making the + * ordeal highly questionable. + */ fdp = p->p_fd; - error = fget_unlocked(fdp, fd, cap_rights_init_one(&rights, CAP_TTYHOOK), - &fp); + FILEDESC_SLOCK(fdp); + error = fget_cap_locked(fdp, fd, cap_rights_init_one(&rights, CAP_TTYHOOK), + &fp, NULL); + FILEDESC_SUNLOCK(fdp); if (error != 0) return (error); if (fp->f_ops == &badfileops) {
