From: David Miller Date: Tue, 11 Sep 2007 22:23:50 +0000 (-0700) Subject: tty: termios locking functions break with new termios type X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=f629307c857c030d5a3dd777fee37c8bb395e171;p=GitHub%2Fmt8127%2Fandroid_kernel_alcatel_ttab.git tty: termios locking functions break with new termios type I ran into a few problems. n_tty_ioctl() for instance: drivers/char/tty_ioctl.c:799: error: $,1rxstruct termios$,1ry has no member named $,1rxc_ispeed$,1ry This is calling the copy interface that is supposed to be using a termios2 when the new interfaces are defined, however: case TIOCGLCKTRMIOS: if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios_locked)) return -EFAULT; return 0; This is going to write over the end of the userspace structure by a few bytes, and wasn't caught by you yet because the i386 implementation is simply copy_to_user() which does zero type checking. Signed-off-by: Alan Cox Cc: "David S. Miller" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c index 3423e9ee6481..4a8969cef315 100644 --- a/drivers/char/tty_ioctl.c +++ b/drivers/char/tty_ioctl.c @@ -796,14 +796,14 @@ int n_tty_ioctl(struct tty_struct * tty, struct file * file, retval = inq_canon(tty); return put_user(retval, (unsigned int __user *) arg); case TIOCGLCKTRMIOS: - if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios_locked)) + if (kernel_termios_to_user_termios_1((struct termios __user *)arg, real_tty->termios_locked)) return -EFAULT; return 0; case TIOCSLCKTRMIOS: if (!capable(CAP_SYS_ADMIN)) return -EPERM; - if (user_termios_to_kernel_termios(real_tty->termios_locked, (struct termios __user *) arg)) + if (user_termios_to_kernel_termios_1(real_tty->termios_locked, (struct termios __user *) arg)) return -EFAULT; return 0;