[smart] lwp: enforce user buffer validation and copyin/copyout in terminal ioctl (#11941)

* [smart] lwp: enforce user buffer validation and copyin/copyout in terminal ioctl

In the RT-Smart terminal subsystem, userspace ioctl commands (such as TIOCGWINSZ, TIOCSWINSZ, TIOCGPGRP, TIOCGSID, FIONREAD, and TIOCGPTN) were previously passed directly to underlying FreeBSD ioctl handlers as raw user pointers without kernel staging or copy validation.

This patch addresses the user pointer dereference sinks:
1. In lwp_tty_ioctl_adapter(), stage arguments in kernel stack buffers and use _copy_from_user() / _copy_to_user() (lwp_get_from_user / lwp_put_to_user) for TIOCGWINSZ, TIOCSWINSZ, TIOCGPGRP, TIOCSPGRP, TIOCGSID, TIOCSTI, TIOCOUTQ, FIONREAD, and modem commands.
2. In ptm_fops_ioctl(), safely buffer arguments for TIOCGPTN, TIOCPKT, TIOCSIG, TIOCGPGRP, TIOCGSID, FIONREAD, TIOCOUTQ, TIOCGWINSZ, TIOCSWINSZ, and termios settings, returning -ENOTTY on unrecognized commands.
3. In tty_generic_ioctl(), add defense-in-depth boundary checks using lwp_in_user_space() to safeguard kernel memory from arbitrary pointer dereferences.

Signed-off-by: Adil Alperen Çiftci <[email protected]>

* [smart] lwp: make the tty ioctl adapters the single uaccess boundary

lwp_tty_ioctl_adapter() and ptm_fops_ioctl() (through
lwp_ptmx_ioctl_forward()) already stage every user argument into a kernel
buffer before entering the BSD tty layer, so tty_generic_ioctl() only ever
sees kernel pointers on the syscall path. Drop the lwp_in_user_space()
branches that were added there, and the older one on TIOCSPGRP, so the
trust boundary is in exactly one place per entry point and the switch no
longer mixes two models.

Zero the staging union in lwp_ptmx_ioctl_forward() before the backend
runs: an *_OUT command copies it back to the caller, and a backend that
returns 0 without filling it would otherwise hand out stack contents.

Add the BSD termios commands TIOCGETA, TIOCSETA, TIOCSETAW and TIOCSETAF
to the /dev/ptmx argument table so they keep reaching the tty layer as
they did before the table existed. The termio-based TCGETA family is not
handled by the BSD layer on this path and stays ENOTTY, as before.

Rename lwp_ptmx_ioctl_arg_type() to lwp_ptmx_ioctl_arg_type_get() so the
function no longer shares its name with the enum tag, rename the test
case to testcases.lwp.tty_ptmx.regression since it covers more than the
buffer bounds, and add the terminal directory to the utest CPPPATH
instead of a relative include.

Signed-off-by: Adil Alperen Ciftci <[email protected]>

* [smart] lwp: drop duplicate termios cases from the ptmx ioctl table

In this port TIOCGETA and TIOCSETA/TIOCSETAW/TIOCSETAF are defined to the
same values as TCGETS and TCSETS/TCSETSW/TCSETSF, so listing both sets
makes the switch fail to compile with duplicate case values. The TCGETS
family entries already cover the BSD names; the test asserts for the BSD
spellings stay valid through the aliases.

Signed-off-by: Adil Alperen Ciftci <[email protected]>

---------

Signed-off-by: Adil Alperen Çiftci <[email protected]>
Signed-off-by: Adil Alperen Ciftci <[email protected]>
Co-authored-by: Adil Alperen Çiftci <[email protected]>
Co-authored-by: Rbb666 <[email protected]>

0 files changed, 0 insertions, 0 deletions