1 files changed, 17 insertions, 7 deletions

diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index abfe24d28c51..95f3596189cf 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -2990,7 +2990,8 @@ static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
 
 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
 {
-        pid_t pgrp;
+        struct pid *pgrp;
+        pid_t pgrp_nr;
         int retval = tty_check_change(real_tty);
 
         if (retval == -EIO)
@@ -3001,14 +3002,23 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
             (current->signal->tty != real_tty) ||
             (real_tty->session != process_session(current)))
                 return -ENOTTY;
-        if (get_user(pgrp, p))
+        if (get_user(pgrp_nr, p))
                 return -EFAULT;
-        if (pgrp < 0)
+        if (pgrp_nr < 0)
                 return -EINVAL;
-        if (session_of_pgrp(pgrp) != process_session(current))
-                return -EPERM;
-        real_tty->pgrp = pgrp;
-        return 0;
+        rcu_read_lock();
+        pgrp = find_pid(pgrp_nr);
+        retval = -ESRCH;
+        if (!pgrp)
+                goto out_unlock;
+        retval = -EPERM;
+        if (session_of_pgrp(pgrp) != task_session(current))
+                goto out_unlock;
+        retval = 0;
+        real_tty->pgrp = pgrp_nr;
+out_unlock:
+        rcu_read_unlock();
+        return retval;
 }
 
 /**