usb-serial: fix oti6858.c segfault in termios handling

The oti6858 usb serial driver should use kernel_termios_to_user_termios/
user_termios_to_kernel_termios to avoid segfaults because the kernel
uses a structure differing from that of user space with a different
size.

Signed-off-by: Thomas Viehmann <tv@beamnet.de>
CC: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
index d7db71eca5209bf386a8edc2286f232c0c8ed886..833ada47fc5429938af9045baa7e9fb68dda4b1a 100644 (file)
--- a/drivers/usb/serial/oti6858.c
+++ b/drivers/usb/serial/oti6858.c
@@ -818,19 +818,17 @@ static int oti6858_ioctl(struct usb_serial_port *port, struct file *file,
 
        switch (cmd) {
                case TCGETS:
-                       if (copy_to_user(user_arg, port->tty->termios,
-                                               sizeof(struct ktermios))) {
+                       if (kernel_termios_to_user_termios((struct ktermios __user *)arg,
+                                                          port->tty->termios))
                                return -EFAULT;
-                       }
                        return 0;
 
                case TCSETS:
                case TCSETSW:   /* FIXME: this is not the same! */
                case TCSETSF:   /* FIXME: this is not the same! */
-                       if (copy_from_user(port->tty->termios, user_arg,
-                                               sizeof(struct ktermios))) {
+                       if (user_termios_to_kernel_termios(port->tty->termios,
+                                               (struct ktermios __user *)arg))
                                return -EFAULT;
-                       }
                        oti6858_set_termios(port, NULL);
                        return 0;