casaroli commented on code in PR #21487:
URL: https://github.com/apache/nuttx/pull/21487#discussion_r4480017887
##########
sched/mqueue/mq_send.c:
##########
@@ -70,23 +70,33 @@
*
****************************************************************************/
-#ifdef CONFIG_DEBUG_FEATURES
static int nxmq_verify_send(FAR FAR struct file *mq, FAR const char *msg,
size_t msglen, unsigned int prio)
{
FAR struct inode *inode = mq->f_inode;
FAR struct mqueue_inode_s *msgq;
+#ifdef CONFIG_DEBUG_FEATURES
if (inode == NULL)
{
return -EBADF;
}
+#endif
msgq = inode->i_private;
Review Comment:
mq_send() and mq_receive() of a descriptor that is not a message queue still
do not give EBADF. Nothing checks the type of the inode, so the i_private of
another driver is used as a struct mqueue_inode_s. With this PR on
qemu-armv8a:nsh and :knsh: mq_send() on a pipe gives EMSGSIZE, and mq_receive()
on a pipe and mq_send() on the console panic the kernel with a data abort at
EL1. The NULL msgq check does not catch this.
Fix: return -EBADF when !INODE_IS_MQUEUE(inode), always on, in
nxmq_verify_send() and nxmq_verify_receive().
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
