From 20fdd28047bfe8fabb7cebbda49386f4cab3c020 Mon Sep 17 00:00:00 2001
From: Justus Winter <4winter@informatik.uni-hamburg.de>
Date: Wed, 6 Nov 2013 14:55:47 +0100
Subject: proc: fix a use-after-free error

If we have to create a new process group, we have to do this before
leaving the current one. The current process group is deallocated if
the process is the last process in that group. Likewise, if the
current group was the last group in the current groups session, the
session is deallocated.

Found using the Clang Static Analyzer.

* proc/pgrp.c (S_proc_setpgrp): Fix use-after-free error.
---
 proc/pgrp.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'proc/pgrp.c')

diff --git a/proc/pgrp.c b/proc/pgrp.c
index d4ea9ee4..a828e179 100644
--- a/proc/pgrp.c
+++ b/proc/pgrp.c
@@ -341,8 +341,14 @@ S_proc_setpgrp (struct proc *callerp,
 
   if (p->p_pgrp != pg)
     {
+      /* If we have to create a new pgrp, we have to do this before
+	 leaving the current one.  p->p_pgrp is deallocated if p is
+	 the last process in that group.  Likewise, if p->p_pgrp was
+	 the last group in p->p_pgrp->pg_session, the session is
+	 deallocated.  */
+      struct pgrp *new = pg ? pg : new_pgrp (pgid, p->p_pgrp->pg_session);
       leave_pgrp (p);
-      p->p_pgrp = pg ? pg : new_pgrp (pgid, p->p_pgrp->pg_session);
+      p->p_pgrp = new;
       join_pgrp (p);
     }
   else
-- 
cgit v1.2.3