tty: termios locking functions break with new termios type
authorDavid Miller <>
Tue, 11 Sep 2007 22:23:50 +0000 (15:23 -0700)
committerLinus Torvalds <>
Wed, 12 Sep 2007 00:21:20 +0000 (17:21 -0700)
I ran into a few problems.

n_tty_ioctl() for instance:

drivers/char/tty_ioctl.c:799: error: $,1rxstruct termios$,1ry has no
member named $,1rxc_ispeed$,1ry

This is calling the copy interface that is supposed to be using
a termios2 when the new interfaces are defined, however:

if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios_locked))
return -EFAULT;
return 0;

This is going to write over the end of the userspace
structure by a few bytes, and wasn't caught by you yet
because the i386 implementation is simply copy_to_user()
which does zero type checking.

Signed-off-by: Alan Cox <>
Cc: "David S. Miller" <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>

index 3423e9ee6481c1874898e448dc7e9712b3b33195..4a8969cef3155657285409f32179984201c4d444 100644 (file)
@@ -796,14 +796,14 @@ int n_tty_ioctl(struct tty_struct * tty, struct file * file,
                                retval = inq_canon(tty);
                        return put_user(retval, (unsigned int __user *) arg);
                case TIOCGLCKTRMIOS:
-                       if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios_locked))
+                       if (kernel_termios_to_user_termios_1((struct termios __user *)arg, real_tty->termios_locked))
                                return -EFAULT;
                        return 0;
                case TIOCSLCKTRMIOS:
                        if (!capable(CAP_SYS_ADMIN))
                                return -EPERM;
-                       if (user_termios_to_kernel_termios(real_tty->termios_locked, (struct termios __user *) arg))
+                       if (user_termios_to_kernel_termios_1(real_tty->termios_locked, (struct termios __user *) arg))
                                return -EFAULT;
                        return 0;