luchianmihai/walnux
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fs/vfs: check if all iov_base are accessible

Browse source 
Check if all `iov_base` are inside accessible address space.

Signed-off-by: wangjianyu3 <wangjianyu3@xiaomi.com>
This commit is contained in:
wangjianyu3 2025-06-04 12:46:16 +08:00 • committed by Xiang Xiao
parent 13fba11e9b
commit 89df084b0e
2 changed files with 25 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
fs/vfs/fs_read.c
View file

@ -159,11 +159,23 @@ ssize_t file_readv(FAR struct file *filep,
FAR const struct iovec *iov, int iovcnt)
{
FAR struct inode *inode;
ssize_t ret = -EBADF;
ssize_t ret;
DEBUGASSERT(filep);
inode = filep->f_inode;
/* Are all iov_base accessible? */
for (ret = 0; ret < iovcnt; ret++)
{
if (iov[ret].iov_base == NULL && iov[ret].iov_len != 0)
{
return -EFAULT;
}
}
ret = -EBADF;
/* Was this file opened for read access? */
if ((filep->f_oflags & O_RDOK) == 0)

13
fs/vfs/fs_write.c
View file

@ -144,7 +144,7 @@ ssize_t file_writev(FAR struct file *filep,
FAR const struct iovec *iov, int iovcnt)
{
FAR struct inode *inode;
ssize_t ret = -EBADF;
ssize_t ret;
/* Was this file opened for write access? */
@ -153,10 +153,21 @@ ssize_t file_writev(FAR struct file *filep,
return -EACCES;
}
/* Are all iov_base accessible? */
for (ret = 0; ret < iovcnt; ret++)
{
if (iov[ret].iov_base == NULL && iov[ret].iov_len != 0)
{
return -EFAULT;
}
}
/* Is a driver registered? Does it support the write method?
* If yes, then let the driver perform the write.
*/
ret = -EBADF;
inode = filep->f_inode;
if (inode != NULL && inode->u.i_ops)
{