linux-kernel - Re: [PATCH v2] x86: fix ktermios-termio conversion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 12 May 2009 09:55:13 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	Arnd Bergmann <arnd@...db.de>
Cc:	x86@...nel.org, linux-kernel@...r.kernel.org,
	Remis Lima Baima <remis.developer@...glemail.com>
Subject: Re: [PATCH v2] x86: fix ktermios-termio conversion


* Arnd Bergmann <arnd@...db.de> wrote:

> The operation with the variable 'c_line' was missing in the function
> 'user_termio_to_kernel_termios'. Also the casting '*(unsigned short *)'
> in the macro 'SET_LOW_TERMIOS_BITS' was a bit 'unhealthy'. So the macro
> was removed and the function was changed to be like in other archs
> (e.g. h8300, m68k, sparc) that have a more elegant solution.
> 
> In the function 'kernel_termios_to_user_termio' the return values of
> the functions calls 'put_user' and 'copy_to_user' were not being
> checked.
> 
> Signed-off-by: Remis Lima Baima <remis.developer@...glemail.com>
> Signed-off-by: Arnd Bergmann <arnd@...db.de>
> ---
> 
> initial patch was wordwrapped, resend
> 
>  arch/x86/include/asm/termios.h |   54 +++++++++++++++++++++++++++------------
>  1 files changed, 37 insertions(+), 17 deletions(-)
> 
> diff --git a/arch/x86/include/asm/termios.h b/arch/x86/include/asm/termios.h
> index f729563..47420df 100644
> --- a/arch/x86/include/asm/termios.h
> +++ b/arch/x86/include/asm/termios.h
> @@ -54,20 +54,37 @@ struct termio {
>  /*
>   * Translate a "termio" structure into a "termios". Ugh.
>   */
> -#define SET_LOW_TERMIOS_BITS(termios, termio, x) { \
> -	unsigned short __tmp; \
> -	get_user(__tmp,&(termio)->x); \
> -	*(unsigned short *) &(termios)->x = __tmp; \
> -}
> -
>  static inline int user_termio_to_kernel_termios(struct ktermios *termios,
>  						struct termio __user *termio)
>  {
> -	SET_LOW_TERMIOS_BITS(termios, termio, c_iflag);
> -	SET_LOW_TERMIOS_BITS(termios, termio, c_oflag);
> -	SET_LOW_TERMIOS_BITS(termios, termio, c_cflag);
> -	SET_LOW_TERMIOS_BITS(termios, termio, c_lflag);
> -	return copy_from_user(termios->c_cc, termio->c_cc, NCC);
> +	unsigned short tmp;
> +
> +	if (get_user(tmp, &termio->c_iflag) < 0)
> +		goto fault;
> +	termios->c_iflag = (0xffff0000 & termios->c_iflag) | tmp;
> +
> +	if (get_user(tmp, &termio->c_oflag) < 0)
> +		goto fault;
> +	termios->c_oflag = (0xffff0000 & termios->c_oflag) | tmp;
> +
> +	if (get_user(tmp, &termio->c_cflag) < 0)
> +		goto fault;
> +	termios->c_cflag = (0xffff0000 & termios->c_cflag) | tmp;
> +
> +	if (get_user(tmp, &termio->c_lflag) < 0)
> +		goto fault;
> +	termios->c_lflag = (0xffff0000 & termios->c_lflag) | tmp;
> +
> +	if (get_user(termios->c_line, &termio->c_line) < 0)
> +		goto fault;
> +
> +	if (copy_from_user(termios->c_cc, termio->c_cc, NCC) != 0)
> +		goto fault;

Hm, that looks a bit ugly and it also adds 150 bytes of bloat to the 
kernel:

drivers/char/tty_ioctl.o:

   text	   data	    bss	    dec	    hex	filename
   4704	      0	      0	   4704	   1260	tty_ioctl.o.before
   4841	      0	      0	   4841	   12e9	tty_ioctl.o.after

(64-bit 'make defconfig', on latest tip:master)

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/