Skip to content

[smart] lwp: enforce user buffer validation and copyin/copyout in terminal ioctl #11941

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
adilalperenciftci wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[smart] lwp: enforce user buffer validation and copyin/copyout in terminal ioctl #11941

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
93 changes: 85 additions & 8 deletions components/lwp/terminal/freebsd/tty.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1146,12 +1146,38 @@ static int tty_generic_ioctl(struct lwp_tty *tp, rt_ubase_t cmd, void *data,
/* This device supports non-blocking operation. */
return 0;
case FIONREAD:
*(int *)data = ttyinq_bytescanonicalized(&tp->t_inq);
{
int nread = ttyinq_bytescanonicalized(&tp->t_inq);
if (lwp_in_user_space((void *)data))
{
if (lwp_put_to_user(data, &nread, sizeof(int)) != sizeof(int))
{
return -EFAULT;
}
}
else
{
*(int *)data = nread;
}
return 0;
}
case FIONWRITE:
case TIOCOUTQ:
*(int *)data = ttyoutq_bytesused(&tp->t_outq);
{
int nused = ttyoutq_bytesused(&tp->t_outq);
if (lwp_in_user_space((void *)data))
{
if (lwp_put_to_user(data, &nused, sizeof(int)) != sizeof(int))
{
return -EFAULT;
}
}
else
{
*(int *)data = nused;
}
return 0;
}
#if BSD_USING_FIO_OWNERSHIP
case FIOSETOWN:
if (tp->t_session != NULL && !tty_is_ctty(tp, td->lwp))
Expand Down Expand Up @@ -1269,21 +1295,50 @@ static int tty_generic_ioctl(struct lwp_tty *tp, rt_ubase_t cmd, void *data,
*(int *)data = TTYDISC;
return 0;
case TIOCGPGRP:
{
int pgrp;
if (!tty_is_ctty(tp, td->lwp))
{
return -ENOTTY;
}

if (tp->t_pgrp != NULL)
*(int *)data = tp->t_pgrp->pgid;
pgrp = (tp->t_pgrp != NULL) ? tp->t_pgrp->pgid : NO_PID;
if (lwp_in_user_space((void *)data))
{
if (lwp_put_to_user(data, &pgrp, sizeof(int)) != sizeof(int))
{
return -EFAULT;
}
}
else
*(int *)data = NO_PID;
{
*(int *)data = pgrp;
}
return 0;
}
case TIOCGSID:
{
int sid;
if (!tty_is_ctty(tp, td->lwp))
{
return -ENOTTY;
}

MPASS(tp->t_session);
*(int *)data = tp->t_session->sid;
sid = tp->t_session->sid;
if (lwp_in_user_space((void *)data))
{
if (lwp_put_to_user(data, &sid, sizeof(int)) != sizeof(int))
{
return -EFAULT;
}
}
else
{
*(int *)data = sid;
}
return 0;
}
case TIOCNOTTY:
return tty_drop_ctty(tp, td->lwp);
case TIOCSCTTY:
Expand Down Expand Up @@ -1338,11 +1393,33 @@ static int tty_generic_ioctl(struct lwp_tty *tp, rt_ubase_t cmd, void *data,
return (error);
case TIOCGWINSZ:
/* Obtain window size. */
*(struct winsize *)data = tp->t_winsize;
if (lwp_in_user_space((void *)data))
{
if (lwp_put_to_user(data, &tp->t_winsize, sizeof(struct winsize)) != sizeof(struct winsize))
{
return -EFAULT;
}
}
else
{
*(struct winsize *)data = tp->t_winsize;
}
return 0;
case TIOCSWINSZ:
/* Set window size. */
tty_set_winsize(tp, data);
if (lwp_in_user_space((void *)data))
{
struct winsize ws;
if (lwp_get_from_user(&ws, data, sizeof(struct winsize)) != sizeof(struct winsize))
{
return -EFAULT;
}
tty_set_winsize(tp, &ws);
}
else
{
tty_set_winsize(tp, data);
}
return 0;
case TIOCEXCL:
tp->t_flags |= TF_EXCLUDE;
Expand Down
115 changes: 96 additions & 19 deletions components/lwp/terminal/freebsd/tty_compat.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -507,45 +507,122 @@ int lwp_tty_ioctl_adapter(lwp_tty_t tp, int cmd, int oflags, void *args, rt_thre
/* Controlling terminal */
case TIOCSCTTY:
case TIOCNOTTY:
error = IOCTL(cmd, RT_NULL, fflags, td);
break;

/* Process group and session ID */
case TIOCGPGRP:
{
int pgrp;
error = IOCTL(TIOCGPGRP, (rt_caddr_t)&pgrp, fflags, td);
if (!error)
{
error = _copy_to_user(args, &pgrp, sizeof(pgrp));
}
break;
}

case TIOCSPGRP:
{
int pgrp;
error = _copy_from_user(&pgrp, args, sizeof(pgrp));
if (!error)
{
error = IOCTL(TIOCSPGRP, (rt_caddr_t)&pgrp, fflags, td);
}
break;
}

case TIOCGSID:
{
int sid;
error = IOCTL(TIOCGSID, (rt_caddr_t)&sid, fflags, td);
if (!error)
{
error = _copy_to_user(args, &sid, sizeof(sid));
}
break;
}

/* TIOCOUTQ */
/* TIOCSTI */
case TIOCGWINSZ:
{
struct winsize ws;
error = IOCTL(TIOCGWINSZ, (rt_caddr_t)&ws, fflags, td);
if (!error)
{
error = _copy_to_user(args, &ws, sizeof(ws));
}
break;
}

case TIOCSWINSZ:
error = IOCTL(cmd, (rt_caddr_t)args, fflags, td);
{
struct winsize ws;
error = _copy_from_user(&ws, args, sizeof(ws));
if (!error)
{
error = IOCTL(TIOCSWINSZ, (rt_caddr_t)&ws, fflags, td);
}
break;
#ifdef USING_BSD_IOCTL_EXT
case TIOCMGET:
args->cmd = TIOCMGET;
error = (sys_ioctl(td, (struct ioctl_args *)args));
}

case TIOCSTI:
{
char ch;
error = _copy_from_user(&ch, args, sizeof(ch));
if (!error)
{
error = IOCTL(TIOCSTI, (rt_caddr_t)&ch, fflags, td);
}
break;
}

case TIOCMBIS:
args->cmd = TIOCMBIS;
error = (sys_ioctl(td, (struct ioctl_args *)args));
case TIOCOUTQ:
case FIONWRITE:
{
int nout;
error = IOCTL(cmd, (rt_caddr_t)&nout, fflags, td);
if (!error)
{
error = _copy_to_user(args, &nout, sizeof(nout));
}
break;
}

case TIOCMBIC:
args->cmd = TIOCMBIC;
error = (sys_ioctl(td, (struct ioctl_args *)args));
case TIOCMGET:
{
int bits;
error = IOCTL(TIOCMGET, (rt_caddr_t)&bits, fflags, td);
if (!error)
{
error = _copy_to_user(args, &bits, sizeof(bits));
}
break;
}

case TIOCMBIS:
case TIOCMBIC:
case TIOCMSET:
args->cmd = TIOCMSET;
error = (sys_ioctl(td, (struct ioctl_args *)args));
{
int bits;
error = _copy_from_user(&bits, args, sizeof(bits));
if (!error)
{
error = IOCTL(cmd, (rt_caddr_t)&bits, fflags, td);
}
break;
#endif /* USING_BSD_IOCTL_EXT */
/* TIOCGSOFTCAR */
/* TIOCSSOFTCAR */
}

case FIONREAD: /* TIOCINQ */
error = (IOCTL(FIONREAD, args, fflags, td));
{
int nread;
error = IOCTL(FIONREAD, (rt_caddr_t)&nread, fflags, td);
if (!error)
{
error = _copy_to_user(args, &nread, sizeof(nread));
}
break;
}

#ifdef USING_BSD_IOCTL_EXT
/* TIOCLINUX */
Expand Down
25 changes: 25 additions & 0 deletions components/lwp/terminal/tty_internal.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,31 @@ extern struct cdevsw bsd_ttydev_methods;

extern struct bsd_fileops bsd_ptsdev_methods;

enum lwp_ptmx_ioctl_arg_type
{
LWP_PTMX_IOCTL_UNSUPPORTED,
LWP_PTMX_IOCTL_NONE,
LWP_PTMX_IOCTL_INT_IN,
LWP_PTMX_IOCTL_INT_OUT,
LWP_PTMX_IOCTL_UINT_OUT,
LWP_PTMX_IOCTL_CHAR_IN,
LWP_PTMX_IOCTL_WINSIZE_IN,
LWP_PTMX_IOCTL_WINSIZE_OUT,
LWP_PTMX_IOCTL_TERMIOS_IN,
LWP_PTMX_IOCTL_TERMIOS_OUT,
};

enum lwp_ptmx_ioctl_arg_type lwp_ptmx_ioctl_arg_type(rt_ubase_t cmd);

typedef rt_size_t (*lwp_ptmx_copy_fn)(void *dst, void *src, rt_size_t size,
void *context);
typedef int (*lwp_ptmx_ioctl_fn)(rt_ubase_t cmd, void *arg, void *context);

int lwp_ptmx_ioctl_forward(rt_ubase_t cmd, void *arg,
lwp_ptmx_copy_fn copy_from_user,
lwp_ptmx_copy_fn copy_to_user,
lwp_ptmx_ioctl_fn ioctl, void *context);

/* bsd devsw porting */
void bsd_devsw_init(struct lwp_ttydevsw *tsw);

Expand Down
Loading
Loading