Repository navigation
[smart] lwp: enforce user buffer validation and copyin/copyout in terminal ioctl - #11941
adilalperenciftci wants to merge 1 commit into
Conversation
…minal ioctl In the RT-Smart terminal subsystem, userspace ioctl commands (such as TIOCGWINSZ, TIOCSWINSZ, TIOCGPGRP, TIOCGSID, FIONREAD, and TIOCGPTN) were previously passed directly to underlying FreeBSD ioctl handlers as raw user pointers without kernel staging or copy validation. This patch addresses the user pointer dereference sinks: 1. In lwp_tty_ioctl_adapter(), stage arguments in kernel stack buffers and use _copy_from_user() / _copy_to_user() (lwp_get_from_user / lwp_put_to_user) for TIOCGWINSZ, TIOCSWINSZ, TIOCGPGRP, TIOCSPGRP, TIOCGSID, TIOCSTI, TIOCOUTQ, FIONREAD, and modem commands. 2. In ptm_fops_ioctl(), safely buffer arguments for TIOCGPTN, TIOCPKT, TIOCSIG, TIOCGPGRP, TIOCGSID, FIONREAD, TIOCOUTQ, TIOCGWINSZ, TIOCSWINSZ, and termios settings, returning -ENOTTY on unrecognized commands. 3. In tty_generic_ioctl(), add defense-in-depth boundary checks using lwp_in_user_space() to safeguard kernel memory from arbitrary pointer dereferences. Signed-off-by: Adil Alperen Çiftci <adilalperenciftci@users.noreply.github.com>
|
👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread! 为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。 🛠 操作步骤 | Steps
完成后，提交将自动更新至 如有问题欢迎联系我们，再次感谢您的贡献！💐 |
github-actions
Bot
added
RT-Smart
📌 Code Review Assignment🏷️ Tag: componentsReviewers: @Maihuanyi Changed Files (Click to expand)
🏷️ Tag: components_lwpReviewers: @xu18838022837 Changed Files (Click to expand)
📊 Current Review Status (Last Updated: 2026-10-28 20:35 CST)
📝 Review Instructions
|
Summary of Changes
In the RT-Smart terminal subsystem, userspace ioctl commands (such as
TIOCGWINSZ,TIOCSWINSZ,TIOCGPGRP,TIOCGSID,FIONREAD, andTIOCGPTN) were previously passed directly to underlying FreeBSD ioctl handlers as raw user pointers without kernel staging or copy validation.This patch addresses the user pointer dereference sinks:
lwp_tty_ioctl_adapter(), stage arguments in kernel stack buffers and use_copy_from_user()/_copy_to_user()(lwp_get_from_user/lwp_put_to_user) forTIOCGWINSZ,TIOCSWINSZ,TIOCGPGRP,TIOCSPGRP,TIOCGSID,TIOCSTI,TIOCOUTQ,FIONREAD, and modem commands.ptm_fops_ioctl(), safely buffer arguments forTIOCGPTN,TIOCPKT,TIOCSIG,TIOCGPGRP,TIOCGSID,FIONREAD,TIOCOUTQ,TIOCGWINSZ,TIOCSWINSZ, and termios settings, returning-ENOTTYon unrecognized commands.tty_generic_ioctl(), add defense-in-depth boundary checks usinglwp_in_user_space()to safeguard kernel memory from arbitrary pointer dereferences.Signed-off-by: Adil Alperen Çiftci adilalperenciftci@users.noreply.github.com