tty: release_one_tty() forgets to put pids

release_one_tty(tty) can be called when tty still has a reference
to pgrp/session. In this case we leak the pid.

Signed-off-by: Oleg Nesterov <[email protected]>
Reported-by: Catalin Marinas <[email protected]>
Reported-and-tested-by: Tetsuo Handa <[email protected]>
Acked-by: Linus Torvalds <[email protected]>
Acked-by: Eric W. Biederman <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index a42c466f7092e2f519f8428be2669ab964a56575..6da962c9b21c880262a883db546ea1c8c7a99764 100644 (file)
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1423,6 +1423,8 @@ static void release_one_tty(struct work_struct *work)
        list_del_init(&tty->tty_files);
        file_list_unlock();
 
+       put_pid(tty->pgrp);
+       put_pid(tty->session);
        free_tty_struct(tty);
 }